EUVD-2026-65171

Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...

EUVD-2026-65174

Unauthenticated Privilege Escalation in TranslatePress = 3.3.2 versions...

OpenSSL Toolkit 4.0.2

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 4.0 release...

CVE-2026-79787: Improper Authentication

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames from unsigned Authorization headers and impersonate any user, including service accounts, to read,...

PT-2026-81131

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

EUVD-2026-66178

aria2 =1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine function...

CVE-2026-75421

aria2 =1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine function...

JetBrains TeamCity < 2020.1.2 (CVE-2020-27627)

The version of JetBrains TeamCity installed on the remote host is prior to 2020.1.2. It is, therefore, affected by a vulnerability: - JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. CVE-2020-27627 Note that Nessus has not tested for this issue but has instead relied only on th...

Fedora 44 : freeipa / samba (2026-903d904933)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-903d904933 advisory. Update to Samba 4.24.6 and rebuild of freeipa ---- This update contains no changes; it exists purely to keep the Fedora 44 freeipa package...

Fedora 43 : kernel (2026-6d18f005f1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6d18f005f1 advisory. The 7.1.10 stable kernel update contains a number of important fixes across the tree. We are now specifying all kernel updates as security because upstream...

Oracle Linux 8 : python3.12 (ELSA-2026-58971)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-58971 advisory. 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227198 Tenable has extracted the preceding description block directly from the Oracle Linux security...

CVE-2026-78284

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78267

Unauthenticated Privilege Escalation in TranslatePress = 3.3.2 versions...

CVE-2026-78264

Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...

CVE-2026-78259

Unauthenticated Broken Authentication in WPLegalPages = 3.7.0 versions...

CVE-2026-32561

Subscriber Privilege Escalation in Booking Hub = 1.3.0 versions...

CVE-2026-27364

Subscriber Broken Access Control in Style Kits = 2.6.5 versions...

CVE-2026-32554

Unauthenticated SQL Injection in WooBeWoo Product Filter Pro = 3.1.8 versions...

CVE-2026-45404

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem an...

CVE-2026-78267

CVE-2026-78267 is an unauthenticated privilege escalation vulnerability in the TranslatePress WordPress plugin, affecting versions 3.3.2 and earlier . With a CVSS 3.1 score of 9.8 (Critical) , the flaw is exploitable over the network with low complexity, requiring no prior authentication or user ...