765853 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-68005
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...
MiracleLinux 9 : p11-kit-0.26.4-1.el9_8 (AXSA:2026-1590:02)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1590:02 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from...
Linux Distros Unpatched Vulnerability : CVE-2026-75147
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 983dae9 contains an out-of-bounds read in the AV1 RTP packetizer libavformat/rtpencav1.c. The keyframe detection loop that searches for a...
Linux Distros Unpatched Vulnerability : CVE-2026-63117
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to ...
Malicious code in append_only_vec (crates.io)
append-only-vec 0.1.9 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and internment releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...
PT-2026-79123
Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9 -+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...
Malicious code in internment (crates.io)
internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...
PT-2026-79028
CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to...
Malicious code in aronenao (crates.io)
aronenao is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...
Malicious code in proc_macro_en (crates.io)
proc-macro-en is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carryin...
PT-2026-79008
ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid course id can upload a...
PT-2026-79044
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...
PT-2026-79116
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...
Photon OS 5.0: Gawk PHSA-2026-5.0-91-0966
An update of the gawk package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0966. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Linux Distros Unpatched Vulnerability : CVE-2026-19672
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it...
Oracle Linux 8 : libgcrypt (ELSA-2026-500138)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500138 advisory. 1.8.5-8fips - Add API to provide hash calculation in RSA/DSA/ECDSA signature operations Orabug: 33081130 - Change Epoch from 1 to 10 1.8.5-8 - Fix...
Oracle Linux 10 : php8.4 (ELSA-2026-56969)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-56969 advisory. 8.4.24-2 - rebase to 8.4.24 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...
Linux Distros Unpatched Vulnerability : CVE-2026-18917
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows...
Linux Distros Unpatched Vulnerability : CVE-2026-11861
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for...
Photon OS 5.0: Gawk PHSA-2026-5.0-92-0966
An update of the gawk package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0966. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...