Oracle Linux 8 / 9 : java-1.8.0-openjdk (ELSA-2026-55775)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55775 advisory. 1.8.0.504.b01-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.504.b01-1.1 - Update to 8u504-b01 GA. - Update release notes for...

cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

cve-2026-47877 - HIGH - Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting XSS...

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader

cve-2026-47885 - MEDIUM - Spring Framework maxPartSize Ignored in PartEventHttpMessageReader...

Virtuozzo Infrastructure 7.3 Update 1 Hotfix 3 (7.3.1-66)

This update provides security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561...

Binding to an Unrestricted IP Address

Overview org.springframework.security:spring-security-ldap is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Binding to an...

Comparison of Object References Instead of Object Contents

Overview Affected versions of this package are vulnerable to Comparison of Object References Instead of Object Contents in the process of comparing UserVerificationRequirement during WebAuthn authentication, when using distributed HTTP session stores. An attacker can bypass user verification by...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView

cve-2026-47884 - MEDIUM - Spring Framework Improper Path Limitation in XsltView...

Fedora 43 : firefox (2026-170e9d62c6)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-170e9d62c6 advisory. - Update to latest upstream 154.0 - Enabled Wayland session restore on KDE. Tenable has extracted the preceding description block directly from the...

PT-2026-80606

These are all security issues fixed in the MozillaThunderbird-140.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2026-231-02)

The version of mozilla-thunderbird installed on the remote host is prior to 140.14.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-231-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

Virtuozzo Infrastructure 7.4 Hotfix 2 (7.4.0-80)

This update provides stability and security fixes. Vulnerability id: VSTOR-140619 A security fix for CVE-2026-64531. Vulnerability id: VSTOR-140678 A security fix for CVE-2026-64561. Vulnerability id: VSTOR-87519 Storage version bumping could remain disabled until the end of a cluster update,...

The vulnerability in the social_login.cgi script of the Zyxel networking device allows attackers to bypass existing security mechanisms.

The vulnerability of the sociallogin.cgi script of the Zyxel networking devices is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC

cve-2026-47879 - HIGH - Spring Cloud Gateway SSRF and native file access with gRPC...

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification

cve-2026-59277 - LOW - Spring Security InetAddressMatchers Incomplete Internal Network Classification...

MiracleLinux 8 : dotnet9.0-9.0.120-1.el8_10 (AXSA:2026-1581:16)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1581:16 advisory. .NET: .NET Core: .NET Security Feature Bypass Vulnerability CVE-2026-62899 .NET: .NET Information Disclosure Vulnerability CVE-2026-62900 .NET: .NET...

Access Control Bypass

Overview org.springframework.security:spring-security-core is a package that provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Access Control Bypass in the InetAddressMatchers process. An attacker can bypass network-based access control...

cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation

cve-2026-59283 - MEDIUM - Spring Framework Safety Guard Bypass via SpEL Expression Compilation...

OPENSUSE-SU-2026:11558-1 MozillaThunderbird-140.14.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-140.14.0-1.1 package on the GA media of openSUSE Tumbleweed...

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

cve-2026-59270 - CRITICAL - Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces...