CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

PT-2026-113660

The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before performing a write, which allows unauthenticated attackers to modify data in an application exposed for anonymous read access ev...

PT-2026-113961

Name of the Vulnerable Software and Affected Versions Nessus affected versions not specified Description An SQL injection allows an authenticated user to read or modify data stored by the system. SQL injection is a technique where malicious SQL statements are inserted into entry fields for...

PT-2026-113725

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

PT-2026-113698

The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's email to destroy or tamper with that...

PT-2026-113677

Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information...

PT-2026-113688

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database...

PT-2026-113621

The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for...

ALSA-2026:82858 Important: python36:3.6 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-114146

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0 Description An issue exists in the wts read drdynvc data first function that allows authenticated clients to cause server resource exhaustion. By sending a seven-byte DATA FIRST message on an opened Dynami...

PT-2026-114360

Three critical authentication bypass flaws in Bisheng open-source LLM DevOps platform allow unauthenticated attackers to gain full admin control and expose cross-user data. Technical Breakdown: - CVE-2026-96679 Legacy SSO Bypass: The POST /user/sso endpoint accepts arbitrary usernames in JSON...

PT-2026-114314

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An authenticated HTTPS origin can provide an HSTS max-age value that is accepted by the parser but fails during subsequent time serialization. On 64-bit systems, extreme max-age values can resul...

Linux Distros Unpatched Vulnerability : CVE-2026-101019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization...

RockyLinux 8 : python36:3.6 (RLSA-2026:82858)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...

PT-2026-114140

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

RHEL 8 : python36:3.6 (RHSA-2026:82858)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82858 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

USB Component Compromise Protected Information

The vulnerability of the USB component in Google Chrome and Microsoft Edge browsers is related to improper authentication procedures. Exploiting this vulnerability allows a remote attacker to compromise the integrity of protected information through a specially created HTML page...

mpfddecode function in the Data Compromise

The vulnerability of the mpfddecode function in the bootloaderregion.bin file of the Emergency HTTP Recovery Server component of the D-Link DCS-930L Wi-Fi camera software is related to insufficient data authentication checks. Exploiting this vulnerability could allow an attacker to compromise the...

Linux Distros Unpatched Vulnerability : CVE-2026-110777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file,...

PT-2026-113656

The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it...