Linux Distros Unpatched Vulnerability : CVE-2026-112816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticat...

Linux Distros Unpatched Vulnerability : CVE-2026-111426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - kdeconnect - None CVE-2026-111426 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable...

openSUSE 16: gvfs / gvfs-backend-afc / gvfs-backend-goa / gvfs-backend-gphoto / etc (openSUSE-SU-2026:22174-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22174-1 advisory. This update for gvfs fixes the following issue: - CVE-2026-88924: gvfs-admin socket ownership race condition allows local users to change the ownership ...

PT-2026-135054

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

FreeBSD : amule -- multiple vulnerabilities (ac97113e-d514-11f1-b2f0-002b67dfc673)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ac97113e-d514-11f1-b2f0-002b67dfc673 advisory. aMule developers report: A security release first: it fixes 15 vulnerabilities reported through GitHub...

Fedora 44 : rust-gst-plugin-reqwest (2026-857be6ce3c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-857be6ce3c advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

PT-2026-135043

Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized, and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource...

CVE-2026-83539: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache Wicket

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escap...

CentOS Linux 7 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1793163099)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1793163099 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses...

SUSE SLED15: flatpak / flatpak-devel / flatpak-remote-flathub / etc (SUSE-SU-2026:4944-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4944-1 advisory. - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and wri...

PT-2026-135051

Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be...

CVE-2026-120274: beecue FastBee: A vulnerability was identified in beecue FastBee up to 2.1.0

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the...

CentOS Linux 7 [TuxCare] Security Update: sudo / sudo-devel (CENTOS7:CLSA-2026:1793183073)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793183073 advisory. - A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z...

Linux Distros Unpatched Vulnerability : CVE-2026-104843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way tha...

Fedora 43 : ruby (2026-8e3e7af1cb)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8e3e7af1cb advisory. New version 3.4.12 is released. This new rpm contains several bug fixes in Onigumo regular expression compilation. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-119374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete that allows attackers to write past the leaf page buffer via crafted...

Fedora 45 : atuin (2026-ab1f2544f2)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ab1f2544f2 advisory. Rebuilt with updated rustls and webpki dependencies, including updated CA certificates for the eMudhra intermediate CA compromise. Tenable has extracted the...

Fedora 43 : rust-cargo-rpmstatus (2026-dcc4b9337f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dcc4b9337f advisory. Rebuilt with updated rustls and webpki dependencies - Fixes RUSTSEC-2026-0346, RUSTSEC-2026-0347, RUSTSEC-2026-0348, RUSTSEC-2026-0349, RUSTSEC-2026-0381,...

FreeBSD : uriparser -- Denial of Service through Unbound Recursion (65abbad5-da78-11f0-b6d5-843a4b343614)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 65abbad5-da78-11f0-b6d5-843a4b343614 advisory. The URIparser project reports: uriparser through 0.9.9 allows unbounded recursion and stack consumption...

Improper Apache Wicket output handling vulnerability

Vulnerabilities related to improper output handling exist in Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. These stem from improper output encoding or escaping; specifically, the JavaScriptUtilsescapeQuotes method fails to escape backslashes,...