CVE-2026-57639: Roland Murg WP Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6...

CVE-2026-108910: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step...

CVE-2026-120646: Access of Resource Using Incompatible Type ('Type Confusion')

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global...

CVE-2026-54375: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that…

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...

CVE-2026-10859: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of...

CVE-2025-71455: vtenext: vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the…

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and...

CVE-2026-113372: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds…

Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadat...

CVE-2026-54378: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user…

VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improperly scoped credentials to list the shared storage bucket an...

CVE-2026-57775: RelyWP Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile…

Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1...

CVE-2026-14252: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-118623: MLflow: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2026-121609: Qihoo 360 Whole Home Router M5: A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2025-71457: vtenext: vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…

vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid username can send action=changepassword to RecoverPwd::displayChangePwd and log ...

CVE-2026-20241: Cisco: A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity…

A vulnerability in the authorization mechanism of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to improper authorization checks. An attacker...

CVE-2026-122028: NST Labs Tech Nstbrowser: A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0

A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has...

CVE-2026-82418: IBM Watson Speech Services Cartridge: IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to…

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability...

Fedora 43 : fractal (2026-db5dd4bc2f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-db5dd4bc2f advisory. 14.3 ---- 14.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

Linux Distros Unpatched Vulnerability : CVE-2026-120635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-da...

TencentOS Server 4: kernel (TSSA-2026:1346)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1346 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-121638: WatchGuard AuthPoint Authentication Gateway: An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path…

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers...