196181 matches found
CVE-2026-35175
Ajenti (Linux/BSD modular server admin panel) contains an authorization bypass vulnerability (CVE-2026-35175) where an authenticated user using the auth_users method could install a custom package even without superuser privileges. Red Hat/NVD entries confirm the issue and that it is fixed in ver...
Updated xz packages fix security vulnerability
Buffer overflow in lzmaindexappend. CVE-2026-34743...
MGASA-2026-0084 Updated xz packages fix security vulnerability
Buffer overflow in lzmaindexappend. CVE-2026-34743...
CVE-2026-35043 BentoML: command injection in cloud deployment setup script (deployment.py)
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.38, the cloud deployment path in src/bentoml/internal/cloud/deployment.py was not included in the fix for CVE-2026-33744. Line 1648 interpolates systempackages directly into a...
GHSA-G68W-W4H2-FR59 vulnerabilities
Vulnerabilities for packages: gitlab-runner...
GHSA-QV7J-4883-HWH7 vulnerabilities
Vulnerabilities for packages: ruby4.0-rack, ruby3.2-rails, logstash, ruby3.4-rails, gitlab-cng, gitlab-rails-ce-fips, pact-broker-docker-fips, ruby3.2-rack, pact-broker-docker, ruby3.3-rack, gitlab-rails-ce, ruby3.4-rack, kube-fluentd-operator...
ajenti 安全漏洞
Ajenti is an open-source Linux and BSD-based modular server management panel developed by ajenti. Versions of Ajenti prior to 2.2.15 contained security vulnerabilities, which stemmed from the ability for unauthenticated users to install custom packages...
Linux Distros Unpatched Vulnerability : CVE-2026-34380
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to...
MiracleLinux 8 : python3-3.6.8-75.el8_10.ML.1 (AXSA:2026-407:04)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-407:04 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly...
Debian: Security Advisory (DSA-6195-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-8148-3)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2026-5e16254ca6)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant. "Every package...
CVE-2026-5557: Authentication Bypass Using an Alternate Path or Channel
A vulnerability was detected in badlogic pi-mono up to 0.58.4. This issue affects some unknown processing of the file packages/mom/src/slack.ts of the component pi-mom Slack Bot. The manipulation results in authentication bypass using alternate channel. The attack can be executed remotely. The...
Linux Distros Unpatched Vulnerability : CVE-2026-23452
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PM: runtime: Fix a race condition related to device removal The following code in pmruntimework may dereference the dev-parent pointer after the parent device...
Fedora 42 : gst-devtools / gst-editing-services / gstreamer1 / gstreamer1-doc / etc (2026-5e16254ca6)
The remote Fedora 42 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-5e16254ca6 advisory. 1.26.11 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...
Linux Distros Unpatched Vulnerability : CVE-2025-66442
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel in RSA and CBC/ECB decryption that only occurs with LLVM's select-optimize feature...
Linux Distros Unpatched Vulnerability : CVE-2026-31391
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto: atmel-sha204a - Fix OOM -tfmcount leak If memory allocation fails, decrement -tfmcount to avoid blocking future reads. CVE-2026-31391 Note that Nessus...
openSUSE 16 Security Update : python-Pillow (openSUSE-SU-2026:20458-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20458-1 advisory. - CVE-2026-25990: Fixed an out-of-bounds write when opening a specially crafted PSD image. bsc1258125 Tenable has extracted the preceding description...
