Adobe Commerce - Authentication Bypass

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high...

PT-2026-68522

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime Utility versions 1.6.0 through 1.6.3 Description A heap-based buffer overflow occurs in the redis client of the Apache Portable Runtime Utility. A heap-based buffer overflow is a memory corruption issue that happens whe...

IBM WebSphere Application Server 8.5.x < 8.5.5.31 / 9.x < 9.0.5.29 (7281628)

The version of IBM WebSphere Application Server running on the remote host is affected by a vulnerability as referenced in the 7281628 advisory. - IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request...

Linux Distros Unpatched Vulnerability : CVE-2026-67591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ...

Fedora 44 : doctl (2026-7ca1b24b3c)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7ca1b24b3c advisory. Update to 1.164.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Important: rclone

Issue Overview: Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing ...

Fedora 44 : open62541 (2026-23b21104ef)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-23b21104ef advisory. Update to 1.5.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

Fedora 44 : nebula (2026-12d6749851)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-12d6749851 advisory. Update to 1.11.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Oracle Linux 10 : p11-kit (ELSA-2026-49668)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49668 advisory. 0.26.4-1 - Rebase to 0.26.4 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not...

VMware Workstation 25.x < 26.0.0 Vulnerability (VMSA-2026-0006)

The version of VMware Workstation installed on the remote host is 25.x 25H2 prior to 26.0.0 26H1. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

Fedora 43 : google-osconfig-agent (2026-4a2d23b470)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4a2d23b470 advisory. Update to 20260717 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

RockyLinux 8 : .NET 8.0 (RLSA-2026:41901)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41901 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

GHSA-45RX-2JWX-CXFR OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Summary @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent without handling decode errors. A single request carrying a malformed percent-encoded value for example a bare % in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the LLB solver and llbsolver operation handling in solver/llbsolver/ops and solver/llbsolver/vertex.go. An attacker can crash the BuildKit daemon by supplying a malicious frontend or LLB definition with...

HPESBNW05082 rev.1 - HPE Telco Automated Assurance, Multiple Vulnerabilities

Potential Security Impact: Local: Compromise of System Integrity; Remote: Denial of Service DoS, Unauthorized Access to Data, Unauthorized Information Disclosure, Unqualified Configuration Change, local memory corruption SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco...

Security update for cyrus-imapd (moderate)

openSUSE security update: security update for cyrus-imapd ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21368-1 Rating: moderate References: bsc1271617 bsc1271618 bsc1271619 bsc1271620 bsc1271621 bsc1271622 bsc1271623 bsc1271624 bsc1271625...

Fedora 44 : libtiff (2026-cfbf964c2e)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cfbf964c2e advisory. updated to 4.7.2, fixes security issues Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

PT-2026-60976

Name of the Vulnerable Software and Affected Versions joe versions prior to 4.6-4.1 Description An issue allows arbitrary command execution through the use of a malicious tags file. Recommendations Update to version 4.6-4.1...

postgresql18 security update

18.4-1.0.1 - Replace upstream reference 18.4-1 - Update to 18.4 - Fix CVE-2026-6478...

CVE-2026-59733

A flaw was found in Rclone. When using the rclone serve restic --private-repos command, an authenticated user can include directory traversal sequences e.g., .. in a request. This allows them to bypass authorization and read, overwrite, or delete another user's private repository on backends that...