EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2423)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 Tenable has extracted the preceding description block directly from the EulerO...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-2424)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : xfrm: esp: avoid in-place decrypt on shared skb fragsCVE-2026-43284 Tenable has extracted the preceding description block directly from the EulerO...

AlmaLinux 9 : mod_http2 (ALSA-2026:25057)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:25057 advisory. httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 Tenable has extracted the preceding description block...

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user...

GHSA-F6VJ-48FM-HMVX Apache Airflow has a Path Traversal issue

The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...

Fedora 43 : putty (2026-61f53cc218)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-61f53cc218 advisory. This is an update fixing several security related problems in putty. Tenable has extracted the preceding description block directly from the Fedora...

Medium: perl-libwww-perl

Issue Overview: LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorizatio...

Important: ruby4.0

Issue Overview: Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cause Net::IMAPstarttls to return "successfully", without starting TLS. This issue has been patched in...

Fedora 43 : perl-CryptX (2026-2ef4c0c642)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2ef4c0c642 advisory. Fixes CVE-2026-41565 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Fedora 44 : perl-CryptX (2026-2158c96917)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2158c96917 advisory. Fixes CVE-2026-41565 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for th...

Slackware Linux 15.0 / current dnsmasq Vulnerability (SSA:2026-155-01)

The version of dnsmasq installed on the remote host is prior to 2.93. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-155-01 advisory. New dnsmasq packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

Fedora 43 : thunderbird (2026-8463c31b61)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8463c31b61 advisory. Update to latest upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2026-33435

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version 5.17. If developers are unable to update...

Security Bulletin: Multiple vulnerabilities in the minimatch package affects IBM® Db2® Big SQL on IBM Cloud Pak for Data.

Summary Multiple vulnerabilities in the minimatch package affects IBM® Db2® Big SQL 8 and earlier on IBM Cloud Pak for Data 5.3.1 and earlier. Vulnerability Details CVEID:CVE-2026-26996 DESCRIPTION: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp...

RockyLinux 10 : expat (RLSA-2026:22715)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:22715 advisory. libexpat: denial of service via crafted XML input CVE-2026-45186 Tenable has extracted the preceding description block directly from the RockyLinux security...

RockyLinux 10 : mod_http2 (RLSA-2026:22528)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:22528 advisory. httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020 Tenable has extracted the preceding description block directly from the RockyLinux...

Fedora 44 : nextcloud (2026-30881a5be7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-30881a5be7 advisory. 33.0.4 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 43 : transmission (2026-893c99f61c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-893c99f61c advisory. 4.1.2, fix for CVE-2026-38978 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

TencentOS Server 4: libexif (TSSA-2026:0328)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0328 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

RockyLinux 10 : iputils (RLSA-2026:18162)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:18162 advisory. iputils: iputils integer overflow CVE-2025-48964 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Note that...