2200 matches found
AlmaLinux 9 : python-tornado (ALSA-2026:13670)
The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:13670 advisory. tornado-python: Tornado: Denial of Service via large multipart bodies CVE-2026-31958 tornado: Tornado: Cookie attribute injection due to improper handlin...
RHEL 9 : sudo (RHSA-2026:13889)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13889 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...
Fedora 43 : insight (2026-e0f5e87dd6)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e0f5e87dd6 advisory. Fix CVE-2026-6846. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
MiracleLinux 9 : grafana-pcp-5.1.1-14.el9_7 (AXSA:2026-539:06)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-539:06 advisory. golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root CVE-2026-32282 crypto/tls: golang: Go crypto/tls: Denial of Service via...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses qs-6.14.1.tgz which is vulnerable to CVE-2026-2391.
Summary IBM Maximo Application Suite - Monitor Component uses qs-6.14.1.tgz which is vulnerable to CVE-2026-2391. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-2391 DESCRIPTION: Summary The arrayLimit option in qs does not enforce limits for...
GHSA-FH64-R2VC-XVHR vulnerabilities
Vulnerabilities for packages: mlflow, mlflow-fips...
Eval Injection
Overview verl is a verl: Volcano Engine Reinforcement Learning for LLM Affected versions of this package are vulnerable to Eval Injection via the mathequal function. An attacker can execute arbitrary code by supplying crafted input that is processed by an unsafe evaluation mechanism. Remediation...
@agentholdings/agent-passport (>=0.1.0 <=0.1.5), @chrysb/alphaclaw (>=0.8.3 <=0.9.0-beta.7) +14 more potentially affected by CVE-2026-42433 via openclaw (>=0.0.1 <=2026.4.1)
openclaw NPM version =0.0.1, =0.1.0, =0.8.3, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider =0.1.1 and more Source cves: CVE-2026-42433 Source advisory: OSV:GHSA-7JP6-R74R-995Q...
CVE-2026-34478 vulnerabilities
Vulnerabilities for packages: apache-activemq-artemis, camunda, commercial-elasticsearch, kafka-bridge, apache-activemq-fips, zipkin, kserve-modelmesh, celeborn, apache-tika-fips, tritonserver-backend-vllm-cuda-13.0, kafka, neo4j, apache-pulsar-fips, solr, sonarqube, spark,...
CVE-2025-57735 vulnerabilities
Vulnerabilities for packages: airflow...
CVE-2026-39399
The CVE affects NuGetGallery, specifically the backend job that processes .nuspec files inside NuGet packages. A crafted nuspec with malicious metadata can trigger cross-package metadata injection due to insufficient input validation, potentially enabling remote code execution (RCE) and arbitrary...
Debian: Security Advisory (DLA-4530-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux 2023 : sudo, sudo-devel, sudo-logsrvd (ALAS2023-2026-1559)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1559 advisory. In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation...
CVE-2026-26962 vulnerabilities
Vulnerabilities for packages: ruby3.4-rails, ruby3.2-rails...
CVE-2022-28108 vulnerabilities
Vulnerabilities for packages: hadoop-fips...
Cross-site Scripting (XSS)
Overview org.webjars.npm:rrweb-snapshot is a rrweb's component to take a snapshot of DOM, aka DOM serializer Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rrweb-snapshot process. An attacker can execute arbitrary web scripts or inject malicious HTML by...
Linux Distros Unpatched Vulnerability : CVE-2026-31842
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs....
Missing Report of Error Condition
Overview github.com/sigstore/cosign/cmd/cosign/cli/verify is a package that aims to make signatures invisible infrastructure. Affected versions of this package are vulnerable to Missing Report of Error Condition in the verify-blob-attestation module when used without --check-claims flag. An...
