PT-2026-114443

Name of the Vulnerable Software and Affected Versions Wheels CLI versions prior to 4.1.1 Description The software fails to verify that the local development server responding to HTTP requests is associated with the current project. A malicious process listening on a targeted local port can...

UBUNTU-CVE-2026-15176

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

CVE-2026-9703: Improper Access Control

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

PT-2026-115131

Name of the Vulnerable Software and Affected Versions CFITSIO versions prior to 4.7.1 Description A heap-based out-of-bounds read exists in the HCOMPRESS tile decoder. An attacker can provide a specially crafted FITS file with ZCMPTYPE set to HCOMPRESS 1 and oversized tile geometry to read past t...

CVE-2026-88842

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

CVE-2026-111313: Server-Side Request Forgery (SSRF)

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-93484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper...

Rocky Linux 8 [CIQ] Security Update: python-nose-docs / python-pymongo-debuginfo / etc (crlsa-2026_82858)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202682858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...

Linux Distros Unpatched Vulnerability : CVE-2026-88842

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single...

AlmaLinux 8 : python36:3.6 (ALSA-2026:82858)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:82858 advisory. pymongo: MongoDB Python Driver: Data disclosure and denial of service via query-operator injection CVE-2026-88029 Tenable has extracted the preceding description...

Unity Linux 20.1070e Security Update: firefox (UTSA-2026-130396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130396 advisory. Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154,...

CVE-2026-24715: Observable Timing Discrepancy

An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: QuRouter 2.7.2.113 and later...

CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

CVE-2026-53575: Improper Neutralization of Input During Web Page Generation

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applicationName setting through CSP nonce injection. The persistent injection is inserted into the main application page without escaping, allowi...

CVE-2026-55154: Improper Neutralization of Formula Elements in a CSV File

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

CVE-2026-78001: Improper Neutralization of Input During Web Page Generation

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...

UBUNTU-CVE-2026-88842

A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited...

UBUNTU-CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

UBUNTU-CVE-2026-105274

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...