CVE-2026-76316: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...

CVE-2026-69550: Buffer Over-read

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...

CVE-2026-19056: Improper Neutralization of Input During Web Page Generation

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-19055: Improper Neutralization of Input During Web Page Generation

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

CVE-2026-55192: Out-of-bounds Read

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP H.264 decoder backends can return YUV planes sized from the bitstream without comparing the decoded width and height to the RDPGFX surface dimensions used to validate region rectangles. A malicious RDP serve...

Linux Distros Unpatched Vulnerability : CVE-2026-69219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1,...

PT-2026-78599

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description A remote attacker can cause a denial of service due to the improper handling of a missing SSL client certificate. SSL Secure Sockets Layer is a protocol used to establish...

CVE-2026-16837: Uncontrolled Resource Consumption

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper handling of a missing SSL client certificate...

CVE-2026-63652: Double Free

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context-clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client...

CVE-2026-63117: Divide By Zero

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the bs calculation in rdpsndserverselectformat in channels/rdpsnd/server/rdpsndmain.c equal zero. The...

PT-2026-78545

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...

Linux Distros Unpatched Vulnerability : CVE-2026-63335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command...

PT-2026-78715

Name of the Vulnerable Software and Affected Versions Remote Desktop Client affected versions not specified Description An out-of-bounds read exists in the Remote Desktop Client, which allows an unauthorized attacker to disclose information over a network. An out-of-bounds read occurs when the...

RHEL 9 : kernel (RHSA-2026:56573)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56573 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: atm: fix crash due to...

Fedora 43 : libnfs (2026-2e196b6fa5)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2e196b6fa5 advisory. Fixes CVE-2026-57918 and CVE-2026-53689 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Linux Distros Unpatched Vulnerability : CVE-2026-63336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0,...

PT-2026-78300

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

PT-2026-78457

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description A buffer overflow occurs in the NIM server process during client registration, leading to a process crash. A buffer overflow is a condition where a program writes more data ...

PT-2026-80244

Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter " " appears. A remote MCP serve...

PT-2026-78301

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...