DRUPAL-CORE-2025-005

Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests...

EUVD-2025-148118

Malicious code in tealove-reborn2 npm...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2025-18814)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-18814 advisory. - Fixes CVE-2025-53057 CVE-2025-53066 - Fixed CVE-2025-21587, CVE-2025-30691 and CVE-2025-30698 Orabug: 37840723 Tenable has extracted the preceding...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2025-2325)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EUVD-2025-102723

Malicious code in rainygazellez3n npm...

EUVD-2025-100109

Malicious code in xaver-nasicampur17-riris npm...

EUVD-2025-88707

Malicious code in soreprimatez3n npm...

EUVD-2025-70998

Malicious code in compactpeacockz3n npm...

Zoom Workplace VDI Client < 6.3.14 Vulnerability (ZSB-25044)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 6.3.14. It is, therefore, affected by a vulnerability as referenced in the ZSB-25044 advisory. - Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of...

Fedora 42 : dotnet8.0 (2025-f74de9283d)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f74de9283d advisory. This is the October 2025 release of .NET 8. Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.21/8.0.121.md - Runtime:...

Fedora 41 : dotnet8.0 (2025-f30852616f)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f30852616f advisory. This is the October 2025 release of .NET 8. Release Notes: - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.21/8.0.121.md - Runtime:...

RHEL 10 : libtiff (RHSA-2025:20998)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20998 advisory. The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: Libtiff...

EUVD-2025-45584

Malicious code in riana-lutis32-sukiwir npm...

Fedora 43 : dolphin-emu (2025-ea90f8d03c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ea90f8d03c advisory. Add CVE and bug fixes to bundled mbedtls in dolphin-emu Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Fedora 42 : singularity-ce (2025-75b28e93c9)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-75b28e93c9 advisory. Upgrade to 4.3.4 upstream version. Build with Go 1.24.9 fixes multiple Go CVEs BZ2408093 BZ2408688 BZ2409563 BZ2410514 BZ2411412 Tenable has extract...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990446)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990446 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91adc: fix possible memory leak in at91adcallocatetrigger If iiotriggerregister retur...

GO-2025-4084 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel

ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989286)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989286 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsihostalloc After device is initialized via deviceinitialize,...

Fedora 44 : varnish (2025-2ff6e32273)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ff6e32273 advisory. Automatic update for varnish-7.7.3-2.fc44. Changelog Wed Oct 29 2025 Lubo Uhliarik - 7.7.3-2 - Add tmpfiles.d rules for /var directories bootc...

Allocation of Resources Without Limits or Throttling

Overview std/net/textproto is a Go standard library package std/net/textproto Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report:The Reader.ReadResponse function constructs a response string through repeated string...