AlmaLinux 8 : grub2 (ALSA-2026:4648)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:4648 advisory. grub2: Missing unregister call for gettext command may lead to use-after-free CVE-2025-61662 Tenable has extracted the preceding description block directly from th...

Oracle Linux 10 : opencryptoki (ELSA-2026-4717)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-4717 advisory. 3.25.0-5.2 - Resolves: RHEL-144815, Privilege Escalation or Data Exposure via Symlink Following Tenable has extracted the preceding description block directly...

@withstudiocms/api-spec (>=0.3.0, <=0.3.1), @withstudiocms/effect (0.4.0) +1 more potentially affected by CVE-2026-32638 via effectify (0.1.1)

effectify NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on effectify and may be impacted: - @withstudiocms/api-spec =0.3.0, =0.4.0, =0.4.3 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-EFFECTIFY-15682413...

GHSA-VHJ5-X93P-67JW vulnerabilities

Vulnerabilities for packages: parseable...

Malicious code in @storylane/shared-packages (npm)

The package '@storylane/shared-packages' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Huawei EulerOS: Security Advisory for containerd (EulerOS-SA-2026-1384)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-25799

Chamilo LMS is a learning management system. Prior to version 1.11.36, an arbitrary file upload vulnerability in the H5P Import feature allows authenticated users with Teacher role to achieve Remote Code Execution RCE. The H5P package validation only checks if h5p.json exists but doesn't block...

MAL-2026-1500 Malicious code in @storylane/shared-packages (npm)

The package '@storylane/shared-packages' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Linux Distros Unpatched Vulnerability : CVE-2026-3644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickling paths were n...

[SECURITY] Fedora 44 Update: python3.11-3.11.15-1.fc44

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...

Linux Distros Unpatched Vulnerability : CVE-2026-23943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Compression Bomb vulnerability in Erlang OTP ssh sshtransport modules allows Denial of Service via Resource Depletio...

Fedora 44 : gst-devtools / gst-editing-services / gstreamer1 / gstreamer1-doc / etc (2026-9cfb46ac78)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-9cfb46ac78 advisory. 1.28.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but h...

Moderate Photon OS Security Update - PHSA-2026-5.0-90-0785

Updates of 'vim' packages of Photon OS have been released...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +41 more potentially affected by CVE-2026-32635 via @angular/core (>=19.0.0, <=19.2.19)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-32635 Source advisory:...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +458 more potentially affected by CVE-2026-2229 via undici (>=7.0.0, <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.33, =0.0.1, =1.0.0, =21.0.0-rc.2, =21.0.0-rc.2, =0.5.0, =1.0.1-dev.120, =12.6.9, =1.0.1-beta.0, =1.0.1-beta.7 and more Source cves: CVE-2026-2229 Source advisory: OSV:GHSA-V9P9-HFJ2-HCW8...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.1.0-dev.260119.0a66443, <=0.3.0) +187 more potentially affected by CVE-2026-2581 via undici (>=7.18.0, <=7.22.0)

undici NPM version =7.18.0, =0.1.1, =0.1.0-dev.260119.0a66443, =0.1.3, =21.1.0-rc.0, =21.1.0-rc.0, =2.8.1, =1.0.1-beta.0, =2026.1.14, =0.13.100, =1.21.1, =0.12.5, =1.2.2, =21.2.2-depup.0, =21.2.3-depup.1 - @depup/directus 11.16.1-depup.0 and more Source cves: CVE-2026-2581 Source advisory:...

EUVD-2026-12050

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-26954 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-26954 Source advisory: OSV:GHSA-6R9F-759J-HJGV...

Malicious Package

Overview cortana-md-bot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

[SECURITY] Fedora 44 Update: python3.12-3.12.13-1.fc44

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...