TencentOS Server 3: rrdtool (TSSA-2026:0622)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0622 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Fedora 43 : openssh (2026-169fd93089)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-169fd93089 advisory. - CVE-2026-59996: Fix remote glob result of .. causing files to be placed in unintended parent directories when scp performs remote-to-remote copy v...

EUVD-2026-45989

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...

Fedora 43 : mingw-python-idna (2026-9dbf4d0ca8)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9dbf4d0ca8 advisory. Update to 3.18. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

TencentOS Server 3: postgresql:12 (TSSA-2026:0649)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0649 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1962)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1962 advisory. When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making archive parsing take exponentially longer. CVE-2026-11972 Tenable has...

Important: python3.12

Issue Overview: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value. CVE-2026-0864 When using the...

CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

CVE-2026-64172 KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h (erratum #1235)

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Disable AVIC IPI virtualization on Hygon Family 18h erratum 1235 Hygon Family 18h CPUs are derived from AMD Family 17h Zen1 silicon and share the same erratum 1235: hardware may read a stale IsRunning=1 bit during ICR...

CVE-2026-64172

CVE-2026-64172 documents a Linux kernel/KVM vulnerability on Hygon Family 18h CPUs (Zen1-derived) where AVIC IPI virtualization could fail to wake blocking vCPUs due to a stale IsRunning=1 bit during ICR emulation. The root cause mirrors AMD Family 17h erratum #1235 and is mitigated by extending ...

CVE-2026-16221

Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the...

CVE-2026-16227

creationtimestamp| type| source ---|---|--- 2026-07-19 12:44:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqyso7g4eb2a 2026-07-19 13:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116946883494385034 2026-07-19 13:30:29+00:00| seen|...

CVE-2026-16228

creationtimestamp| type| source ---|---|--- 2026-07-19 12:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116946529537967968 2026-07-19 12:00:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqyq6lfcsn2r 2026-07-19 12:39:59+00:00| seen|...

CVE-2026-16225 davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write

A security flaw has been discovered in davenardella snap7 up to 1.4.3. The impacted element is the function TSnap7Peer::NegotiatePDULength of the file src/core/s7peer.cpp. The manipulation of the argument PDULength results in out-of-bounds write. The attack can be executed remotely. The exploit h...

PT-2026-61363

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net: tls component where the system could create a chain-after-chain scenario in plain text SG Scatter-Gather. This occurs when the end variable equals 0 while sta...

CVE-2026-10130

creationtimestamp| type| source ---|---|--- 2026-07-18 22:30:23+00:00| seen| https://infosec.exchange/users/offseq/statuses/116943344312678030 2026-07-18 22:30:26+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqxcw4d2h424 2026-07-18 23:35:46+00:00| seen|...

EUVD-2026-45385

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/webshared.go of the component webfetch. Such manipulation leads to server-side request forgery. The attack can be launched remotel...

CVE-2026-11826

OpenPLCv3 contains a heap-based buffer overflow in the getData function in webserver/core/modbusmaster.cpp. getData reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig the function is invoked with the 100-byte...

CVE-2026-11826

OpenPLC_v3 has a heap-based buffer overflow in getData() within webserver/core/modbus_master.cpp. getData() copies data between delimiters into a caller-supplied buffer without size/bounds checks. parseConfig() uses a 100-byte heap-allocated MB_device.dev_name; an authenticated user can POST an o...

CVE-2026-11826 OpenPLC_v3 Heap-Based Buffer Overflow in Modbus Master getData()

OpenPLCv3 contains a heap-based buffer overflow in the getData function in webserver/core/modbusmaster.cpp. getData reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig the function is invoked with the 100-byte...