PT-2026-105595

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve...

PT-2026-105824

A vulnerability was determined in BerriAI litellm up to 1.63.1. The impacted element is an unknown function of the file litellm/proxy/management endpoints/key management endpoints.py of the component Admin Key Handler. This manipulation causes improper authorization. The attack can be initiated...

CVE-2026-104059: Cross-Site Request Forgery (CSRF)

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host...

Rocky Linux 9 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc (crlsa-2025_17084)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517084 advisory. FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA CVE-2025-7493 Tenable has extracted the preceding description block directly from the CIQ...

RockyLinux 10 : gvfs (RLSA-2026:73998)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73998 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable has...

PT-2026-103992

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

CVE-2026-70650: Improper Neutralization of Input During Web Page Generation

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting XSS vulnerability exists in the page backup viewer admin/backup-edit.php. Page fields are correctly HTML-encoded...

PT-2026-103975

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role site admin or higher read and delete arbitrary files on a...

PT-2026-103810

Name of the Vulnerable Software and Affected Versions Ghost versions 5.8.0 through 6.33.x Description An input validation issue exists within the admin iframe. Attackers possessing content publishing privileges can create malicious pages that, when accessed by active staff users, facilitate the...

PT-2026-105828

A security flaw has been discovered in BerriAI litellm up to 1.82.2. This impacts the function authenticate user of the file litellm/proxy/auth/login utils.py of the component PROXY ADMIN database API Key Generator. Performing a manipulation results in session expiration. The attack may be...

Rocky Linux 10.1 [CIQ] Security Update: ipa-client / ipa-client-common / ipa-client-debuginfo / etc (crlsa-2025_20994)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202520994 advisory. FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA CVE-2025-7493 Tenable has extracted the preceding description block directly from the CI...

Rocky Linux 8.8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ciqsa-2026_0333)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260333 advisory. This advisory aggregates security fixes for the tomcat SRPM in CIQ LTS 8.8. It addresses 3 CVEs: CVE-2025-24813, CVE-2024-24549, CVE-2024-23672. Tenable...

PT-2026-103994

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

Important: gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol FTP, Secure Shell File Transfer Protocol SFTP, Web Distributed Authoring and Versioning WebDAV, Common Internet File System CIFS, Server Message Block SMB, and...

CVE-2026-71542: Improper Neutralization of Input During Web Page Generation

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting XSS in the "Theme to Components" functionality admin/components.php via the title parameter. The...

PT-2026-103738

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

PT-2026-104059

Name of the Vulnerable Software and Affected Versions ClipBucket versions 5 through 5.5.3-197 Description Authenticated users with ad manager access permission can perform SQL injection via the delete parameter in the 'admin area/ads manager.php' endpoint. By using time-based blind payloads...

CVE-2026-103278: Relative Path Traversal

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-55230: Improper Neutralization of Input During Web Page Generation

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content...

RockyLinux 9 : pki-core (RLSA-2026:73766)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73766 advisory. pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogtag...