Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2026-1281 & CVE-2026-1340)

Update 29 Jan: Step by Step RPM Install KB included Update 4 Feb: Fixed in Security Update: 0S-4 and 0L-4 included Update: 6 Feb: RPM detection script available to help customers assess potential impact. Technical Analysis updated with reliable Indicators of Compromise IoC’s. Both in partnership...

PT-2026-5241

Name of the Vulnerable Software and Affected Versions SEMCMS version 5.0 Description A security issue exists in SEMCMS 5.0 related to SQL injection. The issue is located in the /SEMCMS Info.php file, where manipulation of the searchml argument can lead to a successful attack. This attack can be...

CVE-2025-70982

Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data...

CVE-2026-1103

CVE-2026-1103 affects the WordPress AIKTP plugin up to version 5.0.04. The vulnerability arises from missing authorization checks on the /aiktp/getToken REST endpoint, which uses verify_user_logged_in (only confirming login) and does not verify administrative capabilities. As a result, authentica...

WordPress AIKTP plugin <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions vulnerability

Missing Authorization to Authenticated Subscriber+ Multiple Administrator Actions vulnerability discovered by Os in WordPress Plugin AIKTP versions = 5.0.04...

CVE-2026-24622

CVE-2026-24622 is a Missing Authorization vulnerability in the WordPress plugin “Suggestion Toolkit” (suggestion-toolkit) affecting versions up to and including 5.0. The issue allows exploitation of incorrectly configured access control, enabling unauthorized access due to missing authorization c...

CVE-2026-24622 WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Suggestion Toolkit: from n/a through = 5.0...

WordPress Plugin RSS Aggregator Cross-Site Script Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-24117

Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate...

CVE-2025-69313 WordPress PostX plugin <= 5.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PostX: from n/a through = 5.0.3...

CVE-2026-21952

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

CVE-2026-21949

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

MiracleLinux 8 : dotnet5.0-5.0.211-1.el8.ML.1 (AXSA:2022-3061:07)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3061:07 advisory. dotnet: ASP.NET Core Krestel HTTP headers pooling denial of service CVE-2022-219862 Tenable has extracted the preceding description block directly from the...

CVE-2025-14375 RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004011)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004011 advisory. In the Linux kernel before 5.0.6, there is a NULL pointer dereference in dropsysctltable in fs/proc/procsysctl.c, related to putlinks, aka CID-23da9588037e. Tenable...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003578)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003578 advisory. The Siemens R3964 line discipline driver in drivers/tty/nr3964.c in the Linux kernel before 5.0.8 has multiple race conditions. Tenable has extracted the preceding...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003622 advisory. A flaw was found in the Linux kernel's freescale hypervisor manager implementation, kernel versions 5.0.x up to, excluding 5.0.17. A parameter passed to an ioctl was...

CVE-2026-0712

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-0712

CVE-2026-0712 entry is rejected/not used by its CNA.

PT-2026-2985

Name of the Vulnerable Software and Affected Versions Grafana OSS versions prior to 12.0.2+security-01 Grafana OSS versions prior to 11.6.3+security-01 Grafana OSS versions prior to 11.5.6+security-01 Grafana OSS versions prior to 11.4.6+security-01 Grafana OSS versions prior to 11.3.8+security-0...