CVE-2026-95760: Hewlett Packard Enterprise (HPE) Fabric Composer: A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions…

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privileges to gain elevated privileges on the affected system...

CVE-2026-95765: Hewlett Packard Enterprise (HPE) Fabric Composer: A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric…

A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information...

RHEL 9 : kernel (RHSA-2026:94477)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:94477 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: ets: Always remove...

RHEL 8 : kernel (RHSA-2026:94623)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:94623 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv4: free inetopt and ireqopt after a...

Linux Distros Unpatched Vulnerability : CVE-2026-120063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long...

CVE-2026-92610: Eclipse Foundation Eclipse Semantic Modeling Framework (ESMF): In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model…

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing...

CVE-2026-95761: Hewlett Packard Enterprise (HPE) Fabric Composer: An improper certificate validation vulnerability exists in HPE Networking Fabric Composer

An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to obtain sensitive information...

CVE-2026-106991: n/a: hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control

hustoj =24.09.10 and =26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread including admins' announcements via threadadmin.php. The thread branch only verifies login, never authorship or admin rights...

CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-103429: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…

An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory...

CVE-2026-121578: Amidaware Tactical RMM: Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various…

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

CVE-2026-108047: AM System ALO Suite: Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepti...

CVE-2026-121402: FreeRDP: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash…

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap upda...

CVE-2026-121403: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a…

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting...

CVE-2026-97350: Securepoint Securepoint SSL VPN Client v2: Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy…

Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: Improper authorizati...

CVE-2026-121421: surrealdb: SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching…

SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules HOST:PORT or IP:PORT match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http:: functio...

CVE-2026-108050: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-119843: Red Hat, GStreamer project: A flaw was found in GStreamer's gst-plugins-good package

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a...

CVE-2026-99257: Linux: In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of…

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...