EUVD-2026-68639

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

PT-2026-83837

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the...

PT-2026-83953

The LwM2M JSON content formatter's get string in subsys/net/lib/lwm2m/lwm2m rw json.c copies a parsed JSON string into a caller-supplied buffer and NUL-terminates it. The length guard used if string length buflen, which accepts a string whose length is exactly buflen. After memcpy fills the whole...

Linux Distros Unpatched Vulnerability : CVE-2026-80612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: lwtunnel: Drop skb metadata before LWT encapsulation skb metadata is meant for passing information between XDP and TC. It lives in the skb headroom,...

PT-2026-83667

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity filter/3 built the update/destroy filter direct...

PT-2026-83882

A vulnerability has been found in armink struct2json 1.0. This affects the function S2J STRUCT GET string ELEMENT in the library struct2json/inc/s2jdef.h of the component JSON Deserialization. The manipulation of the argument valuestring leads to null pointer dereference. The attack may be...

Amazon Linux 2023 : perl-DBI, perl-DBI-tests (ALAS2023-2026-2075)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2075 advisory. DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte,...

Amazon Linux 2023 : openssl, openssl-devel, openssl-fips-provider-latest (ALAS2023-2026-2088)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2088 advisory. Issue summary: When an OpenSSL QUIC server Listener SSL object processesvalid QUIC Initial packets for unknown destination connection IDs, itcan allocate and queue new incoming channels without enforci...

Fedora 44 : bubblewrap (2026-3d9bd126ce)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3d9bd126ce advisory. Update to 0.12.0 Fixes GHSA-pxhw-h44j-8pfx Reset disposition of SIGCHLD, restoring normal subprocess management if bwrap1 was run from a process that was...

RHEL 9 : dbus-broker (RHSA-2026:61355)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61355 advisory. dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, whi...

MiracleLinux 9 : NetworkManager-1.54.3-5.el9_8.ML.1 (AXSA:2026-1704:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1704:07 advisory. NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend CVE-2026-10805 Tenable has extracted the preceding...

SUSE SLES15 Security Update : rootlesskit (SUSE-SU-2026:3822-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3822-1 advisory. This update for rootlesskit rebuilds it against the current go security release. Tenable has extracted the preceding description block...

RHEL 9 : NetworkManager (RHSA-2026:61243)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61243 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

RHEL 9 : pam (RHSA-2026:61230)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61230 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...

Linux Distros Unpatched Vulnerability : CVE-2026-81497

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - security update CVE-2026-81497 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable,...

Linux Distros Unpatched Vulnerability : CVE-2026-80630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schfqcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever fqcodel drops packets during peek, it calls...

Linux Distros Unpatched Vulnerability : CVE-2026-18698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that...

SUSE SLES15 Security Update : buildah (SUSE-SU-2026:3817-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3817-1 advisory. This update for buildah rebuilds it against the current go security release. Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-80618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free amdgpuamdkfdgpuvmfreememoryofgpu unpinned DOORBELL and MMIO remap BOs which are pinned at allocation...

Linux Distros Unpatched Vulnerability : CVE-2026-80701

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/vmwgfx: enforce cursor size limits for MOB cursors vmwcursorplaneatomiccheck bounds cursor width and height only on the legacy update path; the...