CVE-2026-19635 Local Privilege Escalation

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19635

CVE-2026-19635 is a local privilege escalation in Security Center. The advisory states: an attacker with write access to a specific configuration file can achieve arbitrary code execution with elevated privileges, without user interaction. The entry is listed in the Tenable advisory for Security ...

CVE-2026-19635

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

CVE-2026-19628

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-13196 Out-of-bounds Write in KUNBUS piControl

Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local authenticated attacker with device configuration access to write attacker-controlled data outside the bounds of the...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

CVE-2026-19768

Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...

EUVD-2026-58644

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.customjobs that execute via Symfony...

GO-2025-3842 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

GO-2026-4352 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2022-1144 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, kubeflow, kubeflow-katib...

GO-2025-4006 vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, mage, docker-credential-acr-env, xcaddy, prometheus-alertmanager, rancher-loglevel, mockery, envconsul, kratos, chartmuseum, dask-gateway, fscrypt, kpt, helm-push, gobump, vertical-pod-autoscaler, gcsfuse, rancher-telemetry, nodetaint,...

JLSEC-2026-1323 In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over...

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not...

EUVD-2026-58594

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

CVE-2026-15970 vulnerabilities

Vulnerabilities for packages: consul-fips, consul...

PT-2026-71999

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.13 Description Failure to enforce API key scope caps in ConfigController super-scope gates allows scoped keys to modify scheduler configuration. An attacker possessing a scoped api.config.write key can...

CVE-2026-19908: Missing Authentication for Critical Function

PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The...