ServiceNow - Cross-Site Scripting

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript. id: CVE-2022-38463 info: name: ServiceNow - Cross-Site Scripting author: amanrawat...

Intel Active Management - Authentication Bypass

Intel Active Management platforms are susceptible to authentication bypass. A non-privileged network attacker can gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology AMT and Intel Standard Manageability. A non-privileged local attacker can provision...

CVE-2026-56852 affecting package containerd2 for versions less than 2.2.4-6

CVE-2026-56852 affecting package containerd2 for versions less than 2.2.4-6. A patched version of the package is available...

CVE-2026-56852 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-6

CVE-2026-56852 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-6. A patched version of the package is available...

CVE-2026-56852 affecting package kured for versions less than 1.15.0-6

CVE-2026-56852 affecting package kured for versions less than 1.15.0-6. A patched version of the package is available...

CVE-2026-64726

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An attacker in physical proximity may be able to corrupt process memory...

CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

CVE-2026-66008

Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 expose Pointer and Relation target class names through GraphQL validation and input-coercion error messages when public schema introspection is disabled (graphQLPublicIntrospection: false). Since errors are prod...

Plone Volto < 16.34.1 / 17.x < 17.22.2 / 18.x < 18.27.2 / 19.0.0-alpha.1 < 19.0.0-alpha.6 DoS

The version of the @plone/volto Node.js Package installed on the remote host is prior to 16.34.1, or 17.x prior to 17.22.2, or 18.x prior to 18.27.2, or 19.0.0-alpha.1 prior to 19.0.0-alpha.6. It is, therefore, affected by a denial of service vulnerability. An unauthenticated, remote attacker, ca...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

CVE-2026-45799

The CVE-2026-45799 issue affects com.squareup.wire:wire-runtime (and related artifacts) where ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() fail to reject negative LENGTH_DELIMITED lengths before skip(). A crafted protobuf varint of -128 can drive the internal position negative, ...

CVE-2026-42506 affecting package cni-plugins for versions less than 1.4.0-6

CVE-2026-42506 affecting package cni-plugins for versions less than 1.4.0-6. A patched version of the package is available...

CVE-2026-42502 affecting package cni-plugins for versions less than 1.4.0-6

CVE-2026-42502 affecting package cni-plugins for versions less than 1.4.0-6. A patched version of the package is available...

CVE-2026-53094 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53094 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-48142 affecting package nginx for versions less than 1.28.3-6

CVE-2026-48142 affecting package nginx for versions less than 1.28.3-6. A patched version of the package is available...

CVE-2026-25681 affecting package cni-plugins for versions less than 1.4.0-6

CVE-2026-25681 affecting package cni-plugins for versions less than 1.4.0-6. A patched version of the package is available...

AlmaLinux 8 : redis:6 (ALSA-2026:26008)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26008 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the...

RockyLinux 8 : redis:6 (RLSA-2026:26008)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26008 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the...

NPM: protobufjs : Schema-derived names can shadow runtime-significant properties

NPM: protobufjs : Schema-derived names can shadow runtime-significant properties vulnerability discovered by ? in WordPress Npm protobufjs versions = 7.6.2...

CVE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting clie...