Ubuntu Pro Realtime 22.04 LTS : Linux kernel (Real-time) vulnerabilities (USN-8186-1)

The remote Ubuntu Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8186-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

Photon OS 4.0: Python3 PHSA-2026-4.0-1000

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-1000. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

GHSA-PVXC-VJ6P-FP82 vulnerabilities

Vulnerabilities for packages: chromium...

Oracle Linux 9 : nodejs:24 (ELSA-2026-7350)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7350 advisory. nodejs 1:24.14.1-2 - Update bundled nghttp2 to 1.68.1 1:24.14.1-1 - Update to version 24.14.1 nodejs-nodemon 3.0.3-3 - Keep BR on just npm 3.0.3-2 - Fi...

Fedora 42 : crun (2026-32cf2c53f7)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-32cf2c53f7 advisory. Automatic update for crun-1.27-1.fc42. Changelog for crun Wed Mar 25 2026 Packit - 1.27-1 - Update to 1.27 upstream release Tenable has extracted the precedi...

UBUNTU-CVE-2026-40170

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2qlogparameterssettransportparams serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport...

Fedora 42 : webkitgtk (2026-36594550b0)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-36594550b0 advisory. Update to 2.52.1. Notable changes from 2.50 to 2.52: Make text look like in other browsers by blending in linear color space. Improved rendering...

Command Injection

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Command Injection via the generateP4Command function. An...

Off-by-one Error

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

Exploit for CVE-2025-54416

CVE-2025-54416: tj-actions/branch-names Command Injection PoC...

Oracle Linux 8 : nodejs:24 (ELSA-2026-7670)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-7670 advisory. nodejs 1:24.14.1-2 - Update bundled nghttp2 to 1.68.1 Related: RHEL-151374 1:24.14.1-1 - Update to 24.14.0 Resolves: RHEL-151374 nodejs-nodemon 3.0.3-1...

Fedora 44 : ImageMagick / LibRaw / OpenImageIO / OpenImageIO2.5 / etc (2026-bef0050737)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-bef0050737 advisory. LibRaw 0.22.1 and rebuilds ---- Release 3.1.12.0 Apr 1, 2026 -- compared to 3.1.11.0 oiiotool: Better type understanding with -i:ch= and other clean...

RockyLinux 10 : kernel (RLSA-2026:6632)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:6632 advisory. kernel: Linux kernel net/mlx5: Use-after-free in ECVF vports unload leads to denial of service CVE-2025-38109 kernel: Linux kernel: Local denial of...

GHSA-RRJF-CCR2-PH7G vulnerabilities

Vulnerabilities for packages: firefox...

Photon OS 5.0: Linux PHSA-2026-5.0-0813

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0813. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

@vitejs/plugin-rsc has a Denial of Service with React Server Components

Impact @vitejs/plugin-rsc vendors react-server-dom-webpack, which contained a vulnerability in versions prior to 19.2.4. See details in React repository's advisory https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg Patches Upgrade immediately to @vitejs/[email protected] or...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the parentprojectid update process. An attacker can gain unauthorized administrative privileges by moving a project under a project they own, allowing them to delete the project, manage sharing settings,...

Fedora 42 : kea (2026-66f19b11e0)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-66f19b11e0 advisory. - New version 3.0.3 rhbz2451141 - Fixes CVE-2026-3608 rhbz2451621 Tenable has extracted the preceding description block directly from the Fedora security...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-006584)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006584 advisory. In the Linux kernel, the following vulnerability has been resolved: nullblk: Always check queue mode setting from configfs Make sure to check device queue mode in th...

PT-2026-30806

Name of the Vulnerable Software and Affected Versions Rack::Session versions 2.0.0 through 2.1.1 Description Rack::Session is a session management implementation for Rack. Versions 2.0.0 through 2.1.1 incorrectly handle decryption failures when configured with secrets. If cookie decryption fails,...