Fedora 41 : workrave (2025-d611c8d114)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-d611c8d114 advisory. Unretireing the package. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 40 : workrave (2025-2d5726abb8)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2d5726abb8 advisory. Unretireing the package. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2025-17149 · Unknown · Local Magic

Name of the Vulnerable Software and Affected Versions: Local Magic versions n/a through 2.6.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...

SUSE SLED15 / SLES15 Security Update : pgadmin4 (SUSE-SU-2025:1326-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1326-1 advisory. - CVE-2025-27152: Fixed SSRF and creadential leakage due to requests sent to absolute URL even when baseURL is...

Oracle Linux 8 : webkit2gtk3 (ELSA-2025-3974)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3974 advisory. 2.48.1-1 - Update to 2.48.1 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus ha...

Amazon Linux 2 : ghostscript (ALAS-2025-2820)

The version of ghostscript installed on the remote host is prior to 9.54.0-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2820 advisory. Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather than multipl...

Important: Red Hat Security Advisory: VolSync 0.11.2 security fixes and enhancements for RHEL 9

VolSync v0.11.2 general availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2025-31201

CVE-2025-31201 is an Apple vulnerability that enables an attacker with arbitrary read/write capability to bypass Pointer Authentication. The issue is tied to the RPAC path and is fixed in iOS/iPadOS 18.4.1, tvOS 18.4.1, visionOS 2.4.1, and macOS Sequoia 15.4.1. Public records note high severity (...

CVE-2025-31200

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in tvOS 18.4.1, visionOS 2.4.1, iOS iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a repor...

CVE-2025-3739 Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040

Vulnerability in Drupal Drupal 8 Google Optimize Hide Page.This issue affects Drupal 8 Google Optimize Hide Page:...

Cisco Nexus Dashboard LDAP Username Enumeration Vulnerability

A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication requests. An attacker could exploit this vulnerability by sending authentication requests to an...

Cisco Secure Network Analytics Privilege Escalation Vulnerability

A vulnerability in the web-based management interface of Cisco Secure Network Analytics could allow an authenticated, remote attacker with valid administrative credentials to execute arbitrary commands as root on the underlying operating system. This vulnerability is due to insufficient integrity...

Cisco Webex App Client-Side Remote Code Execution Vulnerability

A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to persuade a user to download arbitrary files, which could allow the attacker to execute arbitrary commands on the host of the targeted user. This vulnerability is due to insufficient inpu...

CVE-2025-22113

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid journaling sb update on error if journal is destroying Presently we always BUGON if trying to start a transaction on a journal marked with JBD2UNMOUNT, since this should never happen. However, while ltp running stress...

CVE-2025-22081

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeofstruct NTFSDE" addition can have an integer wrapping issue. Fix it by using sizeadd...

CVE-2025-22043

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add bounds check for durable handle context Add missing bounds check for durable handle context...

Vulnerabilities fixed in Oracle MySQL

Oracle fixed multiple vulnerabilities in MySQL The vulnerabilities in Oracle MySQL allow malicious parties to launch a denial-of-service attack, gain access to sensitive data or, with sufficient authorizations, affect the operation of the MySQL server. Oracle has released updates to fix the...

Vulnerabilities fixed in Oracle Java

Oracle has fixed vulnerabilities in Oracle Java SE and GraalVM Specifically for versions 17.0.14, 21.0.6, 21.0.6 and 24. The vulnerabilities in Oracle Java SE and GraalVM allow unauthenticated malicious actors with network access to manipulate or access critical data. This can lead to unauthorize...

Vulnerabilities fixed in Oracle Analytics

Oracle has fixed vulnerabilities in Oracle Analytics. The vulnerabilities allow unauthenticated malicious actors to gain access to sensitive data, attack denial-of-service, and even gain complete control of systems. Specific vulnerabilities in Oracle Business Intelligence Enterprise Edition can...

CVE-2025-22113

CVE-2025-22113 — Linux kernel ext4 journal update race (mode C) Affects: Linux kernel with ext4 file system; involved components include ext4, JBD2 journaling, and the update path for superblock writes during shutdown/mount transitions. Summary: The issue arises when an error path can cause an in...