Linux Distros Unpatched Vulnerability : CVE-2026-63033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte...

Linux Distros Unpatched Vulnerability : CVE-2026-51293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode function is invoked subsequent to sqlite3DbFree being called on the aBlob membe...

SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3392-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:3392-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-55707

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the target subnets. An authenticated user can onboard subnets fro...

openSUSE 16: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (openSUSE-SU-2026:21467-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21467-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-61893

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the...

SUSE SLES15 Security Update : kernel (Live Patch 15 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3393-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3393-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.55 fixes various security issues: The following security issues were fixed: -...

Fedora 44 : nextcloud (2026-df06189438)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-df06189438 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Linux Distros Unpatched Vulnerability : CVE-2026-65423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in the UAVariant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write...

The vulnerability of the apply_patch() function in the cJSON_Utils.c component of the library for working with JSON objects in C language allows a attacker to compromise data integrity.

The vulnerability of the applypatch function in the cJSONUtils.c component of the C language JSON object handling library is related to an incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

Linux Distros Unpatched Vulnerability : CVE-2026-9672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152 CVE-2026-9672 CVE-2026-9672 Note tha...

Linux Distros Unpatched Vulnerability : CVE-2026-66756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommende...

Important Photon OS Security Update - PHSA-2026-5.0-92-0936

Updates of 'libtiff' packages of Photon OS have been released...

Exploit for CVE-2026-60004

🚨 CVE-2026-60004 - RCE Critical Remote Code Execution...

CVE-2026-67527

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-65834 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a Cluster...

CVE-2026-67527

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...

CVE-2026-67527

OpenProject prior to v17.6.0 is affected by an improper access control vulnerability in PATCH /api/v3/work_packages/{id} via the _links.fileLinks parameter.Authenticated users with edit_work_packages but without manage_file_links could resolve Storages::FileLink records by raw id, detach or hard-...

CVE-2026-67527 OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/workpackages/id accepted links.fileLinks and allowed authenticated users with editworkpackages but without managefilelinks to resolve Storages::FileLink records by raw id, detach or hard-delete...