CVE-2026-82605 BareBones BBEdit Lasso Language Tokenizer infinite loop

A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The...

CVE-2026-82580 AshAi echoes raw tool exception messages into the conversation, disclosing internal details

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

PT-2026-84002

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

PT-2026-84003

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

PT-2026-84014

Name of the Vulnerable Software and Affected Versions Tailored Tools versions prior to 3.0.3 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-84015

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

PT-2026-84011

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.7 Description Broken access control allows users with the subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 2.7.6...

PT-2026-84028

Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...

PT-2026-84029

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

PT-2026-84008

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

PT-2026-84004

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

PT-2026-84018

Name of the Vulnerable Software and Affected Versions Hash Form versions 1.4.2 and earlier Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files, such as a web shell, without requiring authentication. Recommendations Update Hash Form to a version...

PT-2026-84006

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.13 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 6.2.12...

AIDE 0.19.4

AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...

Denx U-Boot 2026.01-rc4 Integer Overflow

Denx U-Boot versions 2026.01-rc4 and below suffer from multiple integer overflow vulnerabilities...

PT-2026-84025

Name of the Vulnerable Software and Affected Versions SliceWP versions 1.2.10 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-84012

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

Fedora 44 : expat (2026-b4cd43a7dc)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b4cd43a7dc advisory. Rebase to 2.8.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 44 : srt (2026-b182827934)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b182827934 advisory. Update to 1.5.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...