Fedora 43 : perl-JavaScript-Minifier-XS (2026-629b796808)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-629b796808 advisory. 0.16 bump - Fix CVE-2026-56017 and CVE-2026-56018 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Medium: containerd

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Fedora 44 : betterleaks (2026-6f573784e6)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6f573784e6 advisory. Update to 1.6.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

RHEL 10 : 389-ds-base (RHSA-2026:36670)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36670 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDA...

Fedora 43 : betterleaks (2026-97d351d54e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-97d351d54e advisory. Update to 1.6.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

RockyLinux 9 : perl-HTTP-Daemon (RLSA-2026:36187)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:36187 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description block...

Important: gstreamer1-plugins-good

Issue Overview: Heap buffer overflow in the Matroska MKV demuxer when calculating decompressed buffer sizes for bz2-compressed tracks. The issue occurs due to missing parentheses in the buffer size calculation, causing incorrect memory allocation and potential out-of-bounds writes. from...

Important Photon OS Security Update - PHSA-2026-4.0-1053

Updates of 'python3-tornado', 'python3-ujson' packages of Photon OS have been released...

Important: ruby

Issue Overview: Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAPstarttls to return "successfully", without starting TLS. This issue has been patched in...

Juniper Junos OS Vulnerability (JSA110089)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110089 advisory. - A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an adjacent, unauthenticated attacker to...

Medium: containerd

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist...

RockyLinux 9 : skopeo (RLSA-2026:36317)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36317 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive...

Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IKEv2 DoS (cisco-sa-multiprod-ikev2-dos-gPctUqv2)

According to its self-reported version, Cisco IOS Software is affected by a vulnerability. - A vulnerability in the Internet Key Exchange version 2 IKEv2 protocol processing of Cisco Adaptive Security Appliance ASA Software, Cisco Firepower Threat Defense FTD Software, Cisco IOS Software, and Cis...

Amazon Linux 2 : ecs-init, --advisory ALAS2ECS-2026-127 (ALASECS-2026-127)

The version of ecs-init installed on the remote host is prior to 1.105.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-127 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing...

RHEL 9 : kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, kpatch-patch-5_14_0-284_158_1, and kpatch-patch-5_14_0-284_172_1 (RHSA-2026:36532)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36532 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

CVE-2026-53552

creationtimestamp| type| source ---|---|--- 2026-07-07 23:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3sagiirf2r 2026-07-08 00:35:07+00:00| published-proof-of-concept| https://github.com/zhenorzz/goploy/security/advisories/GHSA-26rh-24rg-j3vv 2026-08-31 20:08:22+00:0...

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

Summary From v1.13.2 through v1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the rev:path form, e.g. main:openapi.yaml. External $refs were resolved on that load path even when external ref...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the GetOverview handler in pkg/system/handler.go. An attacker can retrieve aggregate inventory and capacity data for a cluster they are not allowed to access by sending GET /api/v1/overview with x-cluster-name...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...