Linux Distros Unpatched Vulnerability : CVE-2026-63495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in...

Fedora 44 : wordpress (2026-dc0ff85b8b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dc0ff85b8b advisory. WordPress 6.9.7 Release Security update included in this release - Authenticated Author+ remote code execution via malicious file upload on sites th...

Zabbix Server 7.4.x < 7.4.11 Authentication Bypass (ZBX-28071)

The version of Zabbix Server installed on the remote host is 7.4.x prior to 7.4.11. It is, therefore, affected by an authentication bypass vulnerability: - The cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. In deployments that utilize both...

Zabbix 7.0.x < 7.0.28 / 7.4.x < 7.4.12 OOB Read (ZBX-28073)

The version of Zabbix Server installed on the remote host is 7.0.x prior to 7.0.28, or 7.4.x prior to 7.4.12. It is, therefore, affected by an out-of-bounds read vulnerability: - A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing JavaScrip...

AIX : Multiple Vulnerabilities (IJ59565)

The version of AIX installed on the remote host is prior to APAR IJ59565. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59565 advisory. - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in...

ROS-20260821-73-0074

The vulnerability of the recvdone function in the fs/smb/server/transportrdma.c module of the SMB server support in the Linux operating system is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow a malicious actor, operating remotely, ...

PT-2026-79396

Name of the Vulnerable Software and Affected Versions Azure SQL Database affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server-side application to ma...

The vulnerability of the CoreDNS Loop Plugin in the coredns DNS server allows attackers to increase their privileges.

The vulnerability of the CoreDNS Loop Plugin in the coredns DNS server is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to increase their privileges...

CVE-2026-62674: Improper Control of Generation of Code

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/sessionid/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with ed...

CVE-2026-59654: Missing Release of Resource after Effective Lifetime

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

CVE-2026-68745: Improper Verification of Cryptographic Signature

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent will have to spoof the ip address of the IdP or get an url of its own choosing registered in the...

Oracle Essbase (August 2026 CSPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the August 2026 Critical Security Patch Update CSPU. It is, therefore, affected by multiple vulnerabilities: - Vulnerability in Oracle Essbase component: Essbase Web Platform Apache HTTP Server. The...

AlmaLinux 9 : java-1.8.0-openjdk (ALSA-2026:55775)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55775 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has extracted...

Zabbix Server 6.0.x < 6.0.47 / 7.0.x < 7.0.27 / 7.4.x < 7.4.11 DoS (ZBX-28075)

The version of Zabbix Server installed on the remote host is 6.0.x prior to 6.0.47, 7.0.x prior to 7.0.27, or 7.4.x prior to 7.4.11. It is, therefore, affected by a denial of service vulnerability: - An authenticated administrator is able to crash Zabbix server by creating specifically crafted...

AlmaLinux 9 : java-17-openjdk (ALSA-2026:55781)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55781 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 Tenable has extracted...

RockyLinux 10 : java-25-openjdk (RLSA-2026:55798)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55798 advisory. JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Improve font loading CVE-2026-70906 JDK: Enhance TLS...

CVE-2026-77649: Embedded Malicious Code

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-73258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input...

PT-2026-79400

llama.cpp before b8585 contains a use-after-free vulnerability in the RPC server's GRAPH RECOMPUTE handler that allows unauthenticated remote attackers to achieve arbitrary read and write access by storing a computation graph, freeing referenced buffers, and reclaiming freed memory with...

CVE-2026-76131: Use of Hard-coded Credentials

Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain access to Yamaha's activation and content servers...