UBUNTU-CVE-2026-16742

systemd-homed contains a local privilege escalation bug via arbitrary system group addition to a local, logged in, homed-managed user...

Linux Distros Unpatched Vulnerability : CVE-2026-68300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: auth: verify auth requirement when authchunk is NULL sctpauthchunkverify returns true unconditionally when chunk-authchunk is NULL, silently skipping...

RHEL 9 : nodejs:22 (RHSA-2026:52399)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:52399 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

PT-2026-69986

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.0.0 through 1.15.0 Description The unauthenticated account-recovery flow in the server/utils/PasswordRecovery/index.js file uses the recoverAccount function to deduplicate recoveryCodes values before they are trimmed. Th...

The vulnerability of the TrueConf Server software lies in the lack of authentication for critical functions, allowing attackers to execute arbitrary scripts and increase their privileges.

The vulnerability of the TrueConf Server software is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary scripts and increase their privileges...

PT-2026-69961

Name of the Vulnerable Software and Affected Versions Feast affected versions not specified feast-operator affected versions not specified Description Feast and feast-operator use a default configuration of "no auth", which means no security manager is installed. This allows unauthenticated and...

Photon OS 5.0: Bluez PHSA-2024-5.0-91-0207

An update of the bluez package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0207. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2026-68130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the...

Exploit for CVE-2026-64638

🔥 XSS2Shell — CVE-2026-64638 Scanner & PoC Toolkit Behav...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concep...

CVE-2026-19342 code-projects Task Management System Login index.php improper authentication

A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Password results in improper authentication. The attack is possible to be carried out remotely. The...

EUVD-2026-54911

A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Performing a manipulation of the argument Password results in improper authentication. The attack is possible to be carried out remotely. The...

CVE-2026-19342

CVE-2026-19342 affects code-projects Task Management System 1.0, specifically the Login component’s /index.php. The vulnerability arises from manipulating the Password argument, causing improper authentication. The issue is exploitable remotely, and public exploit details are reported. No remedia...

PT-2026-69283

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description An improper authentication issue exists within the Login component in the /index.php file. A remote attacker can bypass authentication by manipulating the Password argument...

Fedora 44 : python-wsgidav (2026-348ad953b4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-348ad953b4 advisory. fixes the following security issues: - CVE-2026-55509 - CVE-2026-55560 Tenable has extracted the preceding description block directly from the Fedor...

Exploit for CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PH...

XSS2SHELL-POC

CVE-2026-64638 — XSS2Shell PoC Proof-of-concept tool for test...

Exploit for CVE-2026-64638

CVE-2026-64638 – XSS2Shell: WordPress login page pre-authentic...

CVE-2026-16590

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-16269

The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, allowing unauthenticated attackers to bypass the API authentication via type juggling and perform privileged actions such as modifying subscriber records and sending emails, when the optional API ha...