Debian dla-4674 : chromium - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4674 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4674-1 [email protected] https://www.debian.org/lts/security/...

Linux Distros Unpatched Vulnerability : CVE-2025-15667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gfisomnalusamplerewrite of the file src/isomedia/avcext.c of the...

Oracle Linux 8 : libtasn1 (ELSA-2026-36728)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36728 advisory. 4.13-6 - Backport the fix for CVE-2025-13151 RHEL-139546 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

RockyLinux 8 : libxml2 (RLSA-2026:36734)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36734 advisory. libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2025-6170 Tenable has extracted the preceding description block directly from th...

PT-2026-56736

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download recent decrypted file wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

PT-2026-56716

The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced...

Fedora 44 : python-nh3 (2026-5ebb12f543)

"The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5ebb12f543 advisory. Update to 0.3.6 Tenable, Inc. The descriptive text and package checks in this plugin were extracted from Fedora Security Advisory FEDORA-2026-5ebb12f543...

Fedora 44 : python-pendulum (2026-2559684e58)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2559684e58 advisory. Update to 3.2.0 final. Update PyO3 to 0.29, fixing RUSTSEC-2026-0176 and RUSTSEC-2026-0177. Tenable has extracted the preceding description block directly fr...

Uncaught Exception

Overview github.com/nats-io/nats-server/v2/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Uncaught Exception in the WebSocket listener routing, which dispatches requests for the...

Uncaught Exception

Overview github.com/nats-io/nats-server/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Uncaught Exception in the WebSocket listener routing, which dispatches requests for the...

Allocation of Resources Without Limits or Throttling

Overview @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the defaultDecodeRpcLimits in which maxIhaveMessageIDs and maxIwantMessageIDs are set to Infinity, allowing...

Open Redirect

Overview waku is a ⛩️ The minimal React framework Affected versions of this package are vulnerable to Open Redirect via the unstableredirect function. An attacker can cause a user to be redirected to an arbitrary external domain by supplying crafted input that is reflected into the HTTP Location...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the handling of protocol length headers in draft versions of the WebSocket protocol. An attacker can cause excessive memory consumption by sending a continuous sequence of byt...

Uncaught Exception

Overview @opentelemetry/propagator-jaeger is an OpenTelemetry Jaeger propagator provides HTTP header propagation for systems that are using Jaeger HTTP header format. Affected versions of this package are vulnerable to Uncaught Exception via the JaegerPropagator class when handling incoming HTTP...

Infinite loop

Overview tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size. Remediation Upgrade...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via unsanitized data source input in the process. An attacker can execute arbitrary SQL commands and gain unauthorized access to sensitive data or create accounts with attacker-controlled credentials by influencing a...

CVE-2026-53343 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53343 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53050 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53050 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-53147 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53147 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-54652 Frigate viewer can read logs exposing admin and camera credentials

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/service endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and...