MiracleLinux 9 : perl-Archive-Tar-2.38-6.el9_8.2 (AXSA:2026-1589:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1589:04 advisory. perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size CVE-2026-9538 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-76219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that...

RHEL 8 : perl-Date-Manip (RHSA-2026:57562)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57562 advisory. Date::Manip is a series of modules designed to make any common date/time operation easy to do. Operations such as comparing two times, determining a...

AlmaLinux 9 : pcp (ALSA-2026:55740)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55740 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets PMDA...

PT-2026-79080

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http cb function in src/http.c tests hm.proto.len with an...

Linux Distros Unpatched Vulnerability : CVE-2026-76956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash...

MAL-2026-14337 Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

java-21-openjdk security update

1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625 1:21.0.12.1.1-1.1 - Update to jdk-21.0.12.1+1 GA - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - This...

RHEL 8 : kernel (RHSA-2026:57253)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57253 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: ieee802154: do not leave...

RHEL 8 / 9 : java-1.8.0-openjdk (RHSA-2026:55775)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55775 advisory. The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Securit...

ipTIME A3004T Remote Code Execution

The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026 and does not filter source IP addresses. A remote attacker can send a crafted EADTYPESENDCMD packet to execute arbitrary commands on the device with root privileges. Exploit Title: ipTIME A3004T - Remote Code Execution Date...

Linux Distros Unpatched Vulnerability : CVE-2026-76221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directiv...

Oracle Linux 7 : ELSA-2026-50109-0: / sssd (ELSA-2026-501090)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-501090 advisory. - Fix CVE-2026-14474 and CVE-2026-14476 Orabug: 39831149 Tenable has extracted the preceding description block directly from the Oracle Linux securit...

GLSA-202608-17 : libssh2: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-17 libssh2: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in libssh2. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

Fortinet FortiSIEM 6.5.x < 7.3.6 / 7.4.x < 7.4.3 / 7.5.0 < 7.5.1 SSRF (FG-IR-26-159)

The version of Fortinet FortiSIEM running on the remote host is 6.5.x through 7.3.x prior to 7.3.6, 7.4.x prior to 7.4.3, or 7.5.0. It is, therefore, affected by a server-side request forgery vulnerability: - A server-side request forgery SSRF vulnerability in FortiSIEM GUI may allow an...

Linux Distros Unpatched Vulnerability : CVE-2026-71138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Linux Distros Unpatched Vulnerability : CVE-2026-43804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue was addressed through improved state management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6...

Linux Distros Unpatched Vulnerability : CVE-2026-62377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the...

PT-2026-79123

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate, which requires the name to match ^a-z0-9 -+$, is reached from save alone, while the path getter returns path.jointhis.server.stacksDir, this.name and Stack.getStack builds...

PT-2026-79028

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/components/annotation-page/audio-workspace/top-bar/audio-right-group.tsx passes attacker-controlled guide Markdown to...