TencentOS Server 3: java-21-openjdk (TSSA-2026:0927)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0927 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apac...

CVE-2026-80182

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

PT-2026-82781

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

PT-2026-82799

Name of the Vulnerable Software and Affected Versions Xiiaozet LK100W affected versions not specified Description A critical management function can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. This may permit...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82794

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

PT-2026-82653

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

PT-2026-82591

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description A symlink-following flaw exists in the verify-usb v2 added-file allowlist scan. The scan uses the rglob function, which in CPython does not descend into symlinked directories and treats the...

CVE-2026-75337

Yu AI Code Mother v4.3 is vulnerable to path traversal in its static resource interface /api/static/{deployKey}/. The user-controlled path is concatenated to the preview root directory without normalization , allowing anonymous attackers to read files outside the intended directory. The vulnerabi...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-37073

Veno File Manager Project 4.4.9 contains an incorrect access control flaw in /vfm-admin/ajax/sendfiles.php that allows an unauthenticated attacker to send emails through the application's configured SMTP server by issuing a POST request with the required parameters and header. A PoC is publicly a...

CVE-2026-37068

An arbitrary file write vulnerability in Veno File Manager Project 4.4.9 affects the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can overwrite any PHP file in the application by sending a specially crafted POST reque...

CVE-2026-79201

Improper access control in Workers in Google Chrome prior to 152.0.797...

PT-2026-82649

Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description A flaw in the domai...

PT-2026-82766

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...

SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3781-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3781-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-81726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on...