MiracleLinux 8 : java-21-openjdk-21.0.6.0.7-1.el8.ML.1 (AXSA:2025-9623:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9623:04 advisory. JDK: Enhance array handling CVE-2025-21502 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note that...

MiracleLinux 8 : dotnet8.0-8.0.114-1.el8_10.ML.1 (AXSA:2025-9765:07)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9765:07 advisory. dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method CVE-2025-24070 Tenable has extracted the preceding description blo...

MiracleLinux 8 : pcs-0.10.18-2.el8_10.6.ML.1 (AXSA:2025-10575:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10575:06 advisory. rexml: REXML ReDoS vulnerability CVE-2024-49761 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note...

MiracleLinux 9 : openssl-3.5.1-4.el9_7.ML.1 (AXSA:2025-11518:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11518:07 advisory. openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9230 Tenable has extracted the preceding description block directly from the MiracleLinu...

MiracleLinux 9 : 389-ds-base-2.5.2-9.el9_5 (AXSA:2025-9914:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9914:03 advisory. 389-ds-base: null pointer dereference leads to denial of service CVE-2025-2487 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : python3.11-3.11.9-7.el9_5.3 (AXSA:2025-9841:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9841:01 advisory. cpython: python: Uncontrolled CPU resource consumption when in http.cookies module CVE-2024-7592 Tenable has extracted the preceding description block direct...

MiracleLinux 8 : lz4-1.8.3-5.el8_10 (AXSA:2025-10510:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10510:01 advisory. lz4: heap-based buffer overflow in LZ4write32 CVE-2019-17543 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 9 : vim-8.2.2637-22.el9_6.1 (AXSA:2025-10959:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10959:02 advisory. vim: Vim path traversal CVE-2025-53906 vim: Vim path traversial CVE-2025-53905 Tenable has extracted the preceding description block directly from...

MiracleLinux 8 : libssh-0.9.6-16.el8_10 (AXSA:2025-11173:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-11173:03 advisory. libssh: Incorrect Return Code Handling in sshkdf in libssh CVE-2025-5372 Tenable has extracted the preceding description block directly from the MiracleLinu...

MiracleLinux 9 : glibc-2.34-168.el9_6.20 (AXSA:2025-10618:11)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10618:11 advisory. glibc: Vector register overwrite bug in glibc CVE-2025-5702 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 8 : glibc-2.28-251.el8_10.25 (AXSA:2025-10701:13)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10701:13 advisory. glibc: Double free in glibc CVE-2025-8058 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note that...

MiracleLinux 9 : expat-2.5.0-5.el9_6 (AXSA:2025-10214:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10214:03 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly...

Mageia: Security Advisory (MGASA-2026-0006)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Deserialization of Untrusted Data

Overview next is a react framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of payloads from HTTP requests to Server Function endpoints. An attacker can cause the server process to enter an infinite loop and hang,...

PT-2025-51134

It was discovered that c-ares incorrectly handled terminating certain queries after a maximum number of attempts. An attacker could possibly use this issue to cause c-ares to crash, resulting in a denial of service. Update Instructions: Run sudo pro fix USN-7925-1 to fix the vulnerability. The...

CVE-2025-11781

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker with local access to the device can extract this key e.g., by analysing the firmware image or memory dump and create valid firmware updat...

CVE-2025-63435

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

PT-2025-47949

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

CVE-2025-63435

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side endpoint responsible for serving update packages for the application does not require any authentication. This allows an unauthenticated remote attacker to freely download official...

Mageia: Security Advisory (MGASA-2025-0264)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...