TencentOS Server 3: perl-IO-Compress (TSSA-2026:0571)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0571 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RHEL 8 : firefox (RHSA-2026:36103)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:36103 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

RHEL 9 : 389-ds-base (RHSA-2026:36198)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36198 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GnuTLS vulnerabilities (USN-8502-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8502-1 advisory. It was discovered that GnuTLS had a timing side-channel when processing malformed ciphertexts in RSA-PSK ClientKeyExchange. A...

Fedora 43 : hplip (2026-7d23917d90)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7d23917d90 advisory. fix CVE-2026-14544 - incomplete fix after CVE-2026-8631 fedora2496773, fedora2496772 Tenable has extracted the preceding description block directly...

AlmaLinux 8 : libreoffice (ALSA-2026:35839)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:35839 advisory. libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation CVE-2026-8357 Tenable has extracted the preceding...

CVE-2026-53648 FOSSBilling: Downloadable product files can be overwritten through filename collisions

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path. When an administrator uploads a file for a downloadable product, FOSSBilling stores the file as md5 under the uploads...

CVE-2026-53645 FOSSBilling's missing self-edit prevention in staff permission management allows persistent privilege escalation

FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in persistent privilege escalation. A staff user that only has...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the handling of HTTP headers in authentication middlewares. An attacker can impersonate users or escalate privileges by injecting underscore-variant headers that bypass canonical header strippin...

CVE-2026-54709

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:29+00:00| published-proof-of-concept| https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-fhf9-m53m-863g...

CVE-2026-53759

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:27+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-r35r-fpx2-jgr4...

CVE-2026-54771

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:22+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-gjgq-w2m6-wr5q 2026-07-10 01:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqax4od5hu2i 2026-07-10...

CVE-2026-53624

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:20+00:00| published-proof-of-concept| https://github.com/gofiber/fiber/security/advisories/GHSA-gv83-gqw6-9j2c...

CVE-2026-54637

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:14+00:00| published-proof-of-concept| https://github.com/dragonflyoss/dragonfly/security/advisories/GHSA-chwm-m7g7-685g...

CVE-2026-55426

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:11+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-798h-hpph-m24j...

CVE-2026-55501

creationtimestamp| type| source ---|---|--- 2026-07-06 22:35:05+00:00| published-proof-of-concept| https://github.com/decolua/9router/security/advisories/GHSA-7cfm-pqrj-xgq7 2026-07-10 16:21:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqckkdhmae2e 2026-07-10 22:20:14+00:00|...

CVE-2026-43928

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN-supplied amount mcgross to the client's balance without validating it against the invoice total. Combined with a $0.05...

GHSA-287W-MXQ6-X2CP

creationtimestamp| type| source ---|---|--- 2026-07-06 21:42:10+00:00| seen| https://gist.github.com/alon710/42394c2aa3975303824ce1e33bac787e...

CVE-2026-55514

vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server application. Any remote user who is...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the httpapi.RequestHost process. An attacker can gain unauthorized access to sensitive data by sending requests with a crafted X-Forwarded-Host header, which is trusted over the real...