CVE-2026-82905: Server-Side Request Forgery (SSRF)

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

CVE-2026-82624: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

PT-2026-83882

Name of the Vulnerable Software and Affected Versions armink struct2json version 1.0 Description An issue exists in the JSON Deserialization component within the library struct2json/inc/s2jdef.h. A remote attacker can cause a null pointer dereference—a condition where the software attempts to rea...

CVE-2026-82666: Improper Control of Generation of Code

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate...

CVE-2026-82609: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

PT-2026-83949

A vulnerability was found in dibo-software diboot 3.8.0. Affected by this issue is some unknown functionality of the file /admin/ of the component Tenant Administrator Management API. Performing a manipulation of the argument tenantId results in improper access controls. The attack may be initiat...

PT-2026-83800

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi mgr.cgi. Performing a manipulation of the argument alias/username/password/volume location results in os command injection. It is possible to initiate the attack...

Fedora 43 : hcloud (2026-b661d1a235)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b661d1a235 advisory. Update to 1.67.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

PT-2026-83647

A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. Th...

PT-2026-83895

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

PT-2026-84052

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8 Description An unauthenticated path traversal issue exists in the Settings component. The writeTraefikConfigInPath function within the packages/server/src/utils/traefik/application.ts file fails to properly...

PT-2026-84033

Name of the Vulnerable Software and Affected Versions kishan0725 Hospital-Management-System version 1.0 Description A security flaw allows remote attackers to perform SQL injection, a technique used to interfere with the queries that an application makes to its database. The issue exists in the...

PT-2026-83845

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be perform...

CVE-2026-82696: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invsearchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to t...

PT-2026-83807

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection exists in the /pages/inv searchfrm.php file. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL commands on...

PT-2026-83772

Name of the Vulnerable Software and Affected Versions klaussilveira GitList version 2.0.0 Description A remote denial of service can be triggered through the XML Parsing component. The issue resides in the SimpleXMLElement function within the src/SCM/System/Git/CommandLine.php file. Recommendatio...

Linux Distros Unpatched Vulnerability : CVE-2026-82820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The...

Linux Distros Unpatched Vulnerability : CVE-2026-82623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UADataValuebackendcopyRange of the file...

CVE-2026-82607: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-82677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer...