Fedora 40 : workrave (2025-2d5726abb8)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2d5726abb8 advisory. Unretireing the package. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Important: libxslt

Issue Overview: xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. CVE-2024-55549 numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored...

Apple MacOSX Security Update (HT122400)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-17017

Name of the Vulnerable Software and Affected Versions Docket Cache versions through 24.07.02 Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This vulnerability allows PHP Loc...

PT-2025-17105 · Woocommerce · Deliver Via Shipos For Woocommerce

Name of the Vulnerable Software and Affected Versions: Deliver via Shipos for WooCommerce versions 2.1.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-17045 · Unknown · Dhanendran Rajagopal Term Taxonomy Converter

Name of the Vulnerable Software and Affected Versions: Dhanendran Rajagopal Term Taxonomy Converter versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means...

PT-2025-17207 · Unknown · Litepubl Cms

Name of the Vulnerable Software and Affected Versions: Litepubl CMS versions 7.0.9 and earlier Description: The issue allows for remote code execution RCE in the admin/service/run endpoint. No information is provided about the estimated number of potentially affected devices worldwide or real-wor...

PT-2025-17026 · Unknown · Hiren Patel Custom Users Order

Name of the Vulnerable Software and Affected Versions: Hiren Patel Custom Users Order versions n/a through 4.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an...

PT-2025-17161 · Unknown · Wpwax Helpgent

Name of the Vulnerable Software and Affected Versions: wpWax HelpGent versions n/a through 2.2.4 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. Recommendations: For versions n/a through 2.2.4, update to a version later than 2.2.4 to resolve...

SUSE SLES15: spacewalk-java / spacewalk-java-config / spacewalk-java-lib / etc (SUSE-SU-2025:1321-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:1321-1 advisory. spacewalk-java: - Version 4.3.85-0: CVE-2025-23392: Filter user input in systems list page. bsc1239826 Tenable has extracted the preceding description...

Low: edk2

Issue Overview: EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service. CVE-2025-2295 Affected Packages: edk2 Note: This advisory is applicable to Amazon Linux 2...

SUSE SLES15 / openSUSE 15 Security Update : mozjs52 (SUSE-SU-2025:1287-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1287-1 advisory. - CVE-2024-56431: Fixed a negative shift in huffdec.c bsc1234837. Tenable has extracted the preceding description block directly from the...

Fedora 40 : mariadb10.11 (2025-e317a33d16)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-e317a33d16 advisory. MariaDB 10.11.11 Release notes: https://mariadb.com/kb/en/mariadb-10-11-11-release-notes/ Tenable has extracted the preceding description block...

PT-2025-16612

Name of the Vulnerable Software and Affected Versions WPDeveloper Essential Addons for Elementor versions n/a through 6.1.9 Description The issue is related to the exposure of sensitive system information to an unauthorized control sphere, allowing the retrieval of embedded sensitive data...

PT-2025-16606 · Cyberchimps · Cyberchimps Responsive Blocks

Name of the Vulnerable Software and Affected Versions: CyberChimps Responsive Blocks versions n/a through 2.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...

PT-2025-16709 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the fixed version Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the stack layout for constructing arguments for the ftrace return to handler function in the return t...

Low: cuda-nvml-devel-12-8

Issue Overview: NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service. CVE-2024-53870...

Medium: glibc

Issue Overview: When the assert function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size. CVE-2025-0395 Affected...

Google Chrome Security Update(stable-channel-update-for-desktop_15-2025-04) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

openSUSE 15 Security Update : chromium (openSUSE-SU-2025:0120-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025:0120-1 advisory. - Chromium 135.0.7049.84 stable release 2025-04-08 boo1240968 CVE-2025-3066: Use after free in Site Isolation Tenable has extracted the preceding...