Ubuntu 26.04 LTS / 26.10 : Perl XS::Parse::Keyword module vulnerability (USN-8940-1)

The remote Ubuntu 26.04 LTS / 26.10 host has a package installed that is affected by a vulnerability as referenced in the USN-8940-1 advisory. It was discovered that the Perl XS::Parse::Keyword module did not correctly handle certain inputs. If a user or automated system were tricked into receivi...

Oracle Linux 9 : openssl (ELSA-2026-500448)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-500448 advisory. 3.5.8-2.0.1fips - Replace upstream references in fips man pages Orabug: 35824276 - Update additional upstream references - Add FIPS package change: add fips...

AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792588358)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792588358 advisory. - For a secondary zone with transfers restricted by TSIG, named may start to serve the data provided in a zone transfer before the...

Linux Distros Unpatched Vulnerability : CVE-2026-109950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched...

Linux Distros Unpatched Vulnerability : CVE-2026-109944

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 does not remove card handles when EmulateSCardReleaseContext releases a smartcard-emulation context, so EmulateSCardTransmit later...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141778)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141778 advisory. The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as globally reachable or private. This affected th...

Amazon Linux 2 : dnsmasq (ALAS-2026-4002)

The version of dnsmasq installed on the remote host is prior to 2.76-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4002 advisory. Amazon Linuxvended DNS resolvers shipped with an older DNSSEC root signing key. For hosts configured with DNSSEC validation enabled...

Linux Distros Unpatched Vulnerability : CVE-2026-109244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without owner-only file...

TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246

TinyPNG uses smart lossy compression techniques to reduce the file size of your PNG files. The module doesn't sufficiently check access to image style derivatives when those files are served via a file stream other than private://. This vulnerability is mitigated by the fact that Drupal must be...

Linux Distros Unpatched Vulnerability : CVE-2026-109945

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARDIOCTLDISCONNECT and SCARDIOCTLTRANSMIT operate...

AlmaLinux 9 : postgresql:16 (ALSA-2026:85791)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:85791 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description...

Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252

Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL. The module has two vulnerabilities. Rabbit Hole behavior can be skipped with a specific query parameter. In these...

Linux Distros Unpatched Vulnerability : CVE-2026-107705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash that allows attackers controlling the password to overwrite stac...

PT-2026-120921

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that ...

PT-2026-120914

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery CSRF. An attacker could trick an editor into visiting a crafted link, which...

PT-2026-120920

This module enables you to generate and serve WebP derivatives of image style images, overriding Drupal core's image style download controller to serve them. The module serves WebP image derivative responses with the HTTP header Cache-Control: public for all file schemes other than the private fi...

PT-2026-120898

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...

PT-2026-120902

This module provides a user interface to select and configure icons, including a form element, a text format filter and several integrations. The module doesn't sufficiently validate icon settings provided by users before they are rendered...

PT-2026-120899

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...

PT-2026-120924

Rabbit Hole lets site builders control what happens when an entity's page is viewed: show it, return an access denied or not found response, or redirect the visitor to another URL. The module has two vulnerabilities. Rabbit Hole behavior can be skipped with a specific query parameter. In these...