Critical Photon OS Security Update - PHSA-2026-4.0-0976

Updates of 'ruby', 'ImageMagick' packages of Photon OS have been released...

AlmaLinux 8 : nfs-utils (ALSA-2026:3938)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:3938 advisory. nfs-utils: rpc.mountd in the nfs-utils privilege escalation CVE-2025-12801 Tenable has extracted the preceding description block directly from the AlmaLinux securi...

Ubuntu: Security Advisory (USN-8059-8)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Distros Unpatched Vulnerability : CVE-2026-26127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. CVE-2026-26127 Note that Nessus relies on the presence of the package...

0.extends.wechat (>=1.0.51, <=1.0.65), 1-test-gulp-1 (>=0.0.1, <=0.0.4) +16135 more potentially affected by CVE-2026-31808 via file-type (>=13.0.3, <=21.3.0)

file-type NPM version =13.0.3, =1.0.51, =0.0.1, =2.2.0-alpha.0, =3.1.4, =1.0.0, =0.0.1, =1.0.0, =3.1.6, =1.0.0, =1.0.0, =0.0.1, =0.0.2, =0.6.4 and more Source cves: CVE-2026-31808 Source advisory: OSV:GHSA-5V7R-6R5C-R473...

org.webjars.npm:canvas (>=2.5.0, <=2.6.0), org.webjars.npm:color-thief (2.2.5) +12 more potentially affected by CVE-2026-31802 via org.webjars.npm:tar (>=0.1.20, <=4.4.19)

org.webjars.npm:tar MAVEN version =0.1.20, =2.5.0, =0.97.5, =0.2.0, =3.4.0, =0.6.19, =2.0.0, =3.1.4, =3.4.1 - org.webjars.npm:tar.gz 1.0.7 Source cves: CVE-2026-31802 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15456202...

CVE-2026-23135 affecting package kernel for versions less than 6.6.126.1-1

CVE-2026-23135 affecting package kernel for versions less than 6.6.126.1-1. A patched version of the package is available...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +68 more potentially affected by CVE-2026-30837 via elysia (>=1.0.9, <=1.4.22)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.3, =1.0.10 and more Source cves: CVE-2026-30837 Source advisory: SNYK:JS-ELYSIA-15469934...

MGASA-2026-0054 Updated yt-dlp packages fix security vulnerability

When yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-geoipfilter, wuzz, victoriametrics, minio-object-browser, aws-privateca-issuer, timescaledb-parallel-copy, aws-eks-pod-identity-agent, crossplane-provider-aws-iam, sqlexporter, dataplaneapi, knative-client, aws-nuke, kubo, kubernetes-dns-node-cache,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, octo-sts, dex, percona-server-mongodb-operator-fips, tempo, ceph-csi-operator, aws-flb-firehose-fips, kube-arangodb, kserve, crossplane-provider-aws-rds-fips, crossplane-provider-aws-kinesis, dask-gateway, kube-metrics-adapter-fips...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, octo-sts, dex, tempo, ceph-csi-operator, aws-flb-firehose-fips, kube-arangodb, kserve, crossplane-provider-aws-rds-fips, crossplane-provider-aws-kinesis, dask-gateway, kube-metrics-adapter-fips, apache-exporter, yunikorn-k8shim,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: rke2-runtime, gitlab-operator-fips, octo-sts, dex, percona-server-mongodb-operator-fips, tempo, ceph-csi-operator, aws-flb-firehose-fips, kube-arangodb, kserve, crossplane-provider-aws-rds-fips, crossplane-provider-aws-kinesis, dask-gateway, kube-metrics-adapter-fips...

CVE-2025-11143 vulnerabilities

Vulnerabilities for packages: dependency-track, akhq, druid, kafka, cloudwatch-exporter, apache-tika, trino, zookeeper, solr, confluent-kafka, cassandra-reaper, spark...

@powersync/cli-core (>=0.0.0-dev-20260305082615, <=0.9.2), @powersync/cli-plugin-config-edit (>=0.0.0-dev-20260305082615, <=0.9.2) +21 more potentially affected by CVE-2026-30870 via @powersync/service-sync-rules (>=0.0.0-dev-20240918082156, <=0.32.0)

@powersync/service-sync-rules NPM version =0.0.0-dev-20240918082156, =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615, =0.0.0-dev-20260305082615, =0.0.0-dev-20250827072023, =0.0.0-dev-20260114113449, =0.0.0-dev-20250827072023, =0.0.0-dev.57b1a567,...

Linux Distros Unpatched Vulnerability : CVE-2026-3086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Linux Distros Unpatched Vulnerability : CVE-2025-69653

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted JavaScript input can trigger an internal assertion failure in QuickJS release 2025-09-13, fixed in commit 1dbba8a88eaa40d15a8a9b70bb1a0b8fb5b552e6...

EulerOS 2.0 SP13 : nasm (EulerOS-SA-2026-1254)

According to the versions of the nasm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : There exists a heap buffer overflow in nasm 2.16.02rc1 GitHub commit: b952891.CVE-2023-31722 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-2920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GStreamer ASF Demuxer Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Linux Distros Unpatched Vulnerability : CVE-2026-1940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size validation check lsize + 8 size, but ...