Thunderstorm

Thunderstorm You don't have 4,000 findings. You have six paths to your crown jewels. A CSPM hands you a flat, deduplicated, severity-sorted list of misconfigurations and leaves you to guess which ones matter. Thunderstorm reasons about reachability : it collects your cloud read-only, models it as...

CVE-2026-103540

A security vulnerability exists in formtools.org Form Tools (versions up to 3.1.1 ) within the Client Settings component. Specifically, the Clients::updateClientSettingsTab function in the file global/code/Clients.class.php fails to properly neutralize special elements used in a template engine w...

CVE-2026-103536

A vulnerability exists in ZongXR Supermarket 1.0.0.0 within the save Endpoint component. Specifically, the OrderController.addOrder function located in order/src/main/java/com/supermarket/order/controller/OrderController.java fails to perform proper authentication. An attacker can remotely execut...

NetRaptor

NetRaptor - ARP Poisoning MITM Tool NetRaptor is a GUI-based ARP poisoning tool built with Python that allows you to scan a network, select a target and gateway, and perform a Man-in-the-Middle MITM attack. This tool is designed for educational purposes and authorized network security testing onl...

EUVD-2026-90463

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533

A path traversal vulnerability exists in the database-servers API Endpoint of David-Crty databasement versions up to 1.7.1 . The flaw is located in the app/Http/Requests/Api/V1/RestoreRequest.php file and stems from the improper handling of the schema_name argument. An attacker can potentially la...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

CVE-2026-103533 David-Crty databasement database-servers API Endpoint RestoreRequest.php 511 path traversal

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...

SSHBuster

SSHBuster SSHBuster is a powerful command-line SSH brute-forcing tool designed for ethical hacking and penetration testing. It performs dictionary-based attacks to find valid SSH login credentials efficiently. Features Brute-force SSH servers using different username and password combinations...

CVE-2026-103531

A stack-based buffer overflow vulnerability exists in OpenSC versions up to 0.27.1 . The flaw is located in the setcos_construct_fci_44 function within the src/libopensc/card-setcos.c file. Specifically, manipulating the type_attr argument can trigger the overflow. This vulnerability can be explo...

AlmaLinux 9.2 [TuxCare] Security Update: procps-ng / procps-ng-devel / procps-ng-i18n (ALMALINUX9.2:CLSA-2024:1718202251)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1718202251 advisory. - Under some circumstances, this weakness allows a user who has access to run the ps utility on a machine, the ability to write almost...

CentOS Linux 8.5 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-export-devel / etc (CENTOS8.5:CLSA-2026:1785562289)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1785562289 advisory. - A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The...

Rocky Linux 9.6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778220630)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778220630 advisory. - Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is...

Rocky Linux 8 [CIQ] Security Update: nss / nss-debuginfo / nss-debugsource / nss-devel / nss-softokn / etc (crlsa-2024_0105)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20240105 advisory. nss: timing attack against RSA decryption CVE-2023-5388 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2024_1691)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20241691 advisory. varnish: HTTP/2 Broken Window Attack may result in denial of service CVE-2024-30156 Tenable has extracted the preceding description block directly from the CIQ...

CentOS Linux 8.4 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (CENTOS8.4:CLSA-2025:1747690042)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2025:1747690042 advisory. - A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certa...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2022_6542)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226542 advisory. ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked CVE-2020-28948 ArchiveTar: improper filename sanitization...

Linux Distros Unpatched Vulnerability : CVE-2026-103222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclzdecompress of the file blosc/blosclz.c of the component blosclz...

AlmaLinux 9.2 [TuxCare] Security Update: grub2-common / grub2-efi-aa64-modules / grub2-efi-x64 / etc (ALMALINUX9.2:CLSA-2026:1788432569)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788432569 advisory. - GNU GRUB aka GRUB2 through 2.12 does not use a constant-time algorithm for grubcryptomemcmp and thus allows side-channel attacks...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784305067)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784305067 advisory. - Libreswan, via the function RSAauthenticatehashsignaturerawrsa, did not correctly verify the length of the authentication hash whe...