The vulnerability of Microsoft Word packages in Microsoft Office and Microsoft 365 Apps for Enterprise, related to the possibility of exploiting memory after release, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Word packages in Microsoft Office and Microsoft 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially created malicious file...

Oracle Linux 9 : bind9.18 (ELSA-2026-7915)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-7915 advisory. - Correct backport issue in the patch CVE-2026-1519 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

RockyLinux 9 : nghttp2 (RLSA-2026:7668)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:7668 advisory. nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination CVE-2026-27135 Tenable has extracted the preceding description block...

Oracle Linux 8 : bind9.16 (ELSA-2026-8155)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-8155 advisory. 32:9.16.23-0.22.5 - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone CVE-2026-1519 Tenable has extracted the preceding description block...

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in...

@grupo-loja/vendure-banner-plugin (1.0.0), @grupo-loja/vendure-conect-envios-plugin (>=1.0.0, <=1.0.1) +54 more potentially affected by CVE-2026-40887 via @vendure/core (>=1.9.5, <=2.2.7)

@vendure/core NPM version =1.9.5, =1.0.0, =0.0.1, =1.0.3, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.2.4 and more Source cves: CVE-2026-40887 Source advisory: SNYK:JS-VENDURECORE-16068909...

@artur-abliazimov/othentic-cli (1.16.6), @cinema9989/contracts (>=1.0.0, <=1.0.11) +22 more potentially affected by CVE-2026-40879 via @nestjs/microservices (>=11.0.1, <=11.1.18)

@nestjs/microservices NPM version =11.0.1, =1.0.0, =3.8.8, =11.0.36, =1.0.0, =1.0.11, =1.0.23, =1.0.1, =1.0.1, =11.0.0, =0.7.0, =1.0.4, =1.0.36, =1.1.0, =1.0.0, =1.1.11 and more Source cves: CVE-2026-40879 Source advisory: SNYK:JS-NESTJSMICROSERVICES-16082546...

Important Photon OS Security Update - PHSA-2026-5.0-0824

Updates of 'glibc' packages of Photon OS have been released...

PT-2026-32968

Name of the Vulnerable Software and Affected Versions Zarf versions 0.23.0 through 0.74.1 Description An arbitrary file write issue exists in the 'zarf package inspect sbom' and 'zarf package inspect documentation' subcommands. These subcommands construct output file paths by joining a...

Photon OS 5.0: Systemd PHSA-2026-5.0-0819

An update of the systemd package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0819. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Ubuntu: Security Advisory (USN-8148-6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2026-4786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitgation of CVE-2026-4519 was incomplete. If the URL contained %action the mitigation could be bypassed for certain browser types the webbrowser.open API could...

Photon OS 4.0: Linux PHSA-2026-4.0-0959

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0959. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-5713

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The profiling.sampling module Python 3.15+ and asyncio introspection capabilities 3.14+, python -m asyncio ps and python -m asyncio pstree features could be use...

3extensions (1.0.1), @51jbs/incremental-coverage-plugin (1.0.5) +605 more potentially affected by CVE-2026-28291 via simple-git (>=3.0.3, <=3.31.1)

simple-git NPM version =3.0.3, =1.0.1, =1.0.1, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =23.0.0, =35.0.0, =1.4.0, =0.26.4, =0.1.5-alpha.0, =1.0.2, =8.7.2, =8.11.4 and more Source cves: CVE-2026-28291 Source advisory: OSV:GHSA-JCXM-M3JX-F287...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: harfbuzz: harfbuzz-14.1.0-2.hum1 aarch64, x8664 harfbuzz-cairo-14.1.0-2.hum1 aarch64, x8664 harfbuzz-devel-14.1.0-2.hum1 aarch64, x8664 harfbuzz-gpu-14.1.0-2.hum1 aarch64, x8664...

Important Photon OS Security Update - PHSA-2026-4.0-0997

Updates of 'strongswan' packages of Photon OS have been released...

RHEL 9 : golang (RHSA-2026:7833)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:7833 advisory. The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: cmd/go: Arbitrary file write via malicious...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1583)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1583 advisory. When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email message...

Important: python3.11

Issue Overview: The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open. CVE-2026-4519 Affected Packages:...