RHEL 8 : mrtg (RHSA-2026:91843)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91843 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

RHEL 8 : aspell (RHSA-2026:92615)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92615 advisory. GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security...

Apache Ambari 3.0.0 (MpackManager) Path Traversal Arbitrary File Write

Summary The Apache Ambari project is aimed at making Hadoop management simpler by developing software for provisioning, managing, and monitoring Apache Hadoop clusters. Ambari provides an intuitive, easy-to-use Hadoop management web UI backed by its RESTful APIs. Description Apache Ambari is...

CVE-2026-119375: SQLite: SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized…

SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr return sta...

CVE-2026-110970: Zakład Ubezpieczeń Społecznych Płatnik: Płatnik uses HTTP protocol to download updates, libraries and support files

Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, obtain transmitted data and replace the original files with their own. This issue was fixed in metric 334 in version 10.02.002...

CVE-2026-119719: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail…

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

PT-2026-133276

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...

CVE-2026-5461: wpmudev: The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including,…

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...

CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

CVE-2026-119343: Stirling-Tools Stirling-PDF: Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized...

CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download tool

SABnzbd is an open source automated Usenet download tool. Prior to 5.1.0Beta3, orphan-job management in sabnzbd/api.py accepts the user-controlled value parameter without path confinement before os.path.join with downloaddir. An absolute path discards that base directory. An attacker with a valid...

CVE-2026-116242: pgadmin.org pgAdmin 4: pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file,…

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

CVE-2026-118990: Improper Link Resolution Before File Access

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that...

PT-2026-133610

Name of the Vulnerable Software and Affected Versions SOCFortress CoPilot versions prior to 0.1.77 Description The application allows admin and analyst users to upload content via the 'POST /api/scoutsuite/generate-gcp-report' endpoint. The system validates the content as GCPScoutSuiteJSON but...

PT-2026-133316

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under th...

CVE-2026-118574: Drupal S3 File System: Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting…

Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0...

CVE-2026-119546: forgejo: Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in…

Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains...

RockyLinux 8 : aspell (RLSA-2026:92615)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:92615 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793346939)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793346939 advisory. - tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect...