CVE-2024-27123 QcalAgent

A cross-site scripting XSS vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later...

EUVD-2024-55769

A cross-site scripting XSS vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later...

SUSE CVE-2026-92489

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrmdevdirectoutput A return value other than 1 from localout means that the skb has been consumed or its ownership was transferred. xfrmdevdirectoutput nevertheless frees the skb on this path, causin...

CVE-2026-17262: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands...

CVE-2026-68928: Exposed Dangerous Method or Function

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does no...

PT-2026-95685

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Insufficient argument validation in the SUID-root nmap wrapper binary on the Collector appliance allows a local attacker with low-privileged access to execute arbitrary commands as root. Th...

PT-2026-95616

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper validation of FTP authentication commands may allow a local attacker to cause a denial of service. Recommendations At the moment, there is no information about a newer version that contains a...

EulerOS Virtualization 2.11.1 : libtiff (EulerOS-SA-2026-3436)

According to the versions of the libtiff package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file...

Linux Distros Unpatched Vulnerability : CVE-2026-92473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIF...

CVE-2026-92747: Invocation of Process Using Visible Sensitive Information

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine VM credentials, such as rootPassword and userPassword. This occurs when the installmachine.py script passes these credentials as...

CVE-2026-91202: UNIX Symbolic Link (Symlink) Following

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

CVE-2026-91203: Race Condition Enabling Link Following

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

PT-2026-95586

Name of the Vulnerable Software and Affected Versions cockpit-machines affected versions not specified Description A flaw in the cockpit-machines component allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords. This occurs because the component...

PT-2026-95634

Name of the Vulnerable Software and Affected Versions cockpit-files versions prior to 44-1.1 Description A flaw in the "Paste as owner" function allows a low-privileged local user to change arbitrary file ownership outside the intended directory. This is achieved by crafting a directory containin...

CVE-2026-93689: NULL Pointer Dereference

WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails to validate the volume context before use. An unprivileged local user can trigger a denial of service by opening the WinFsp control device and issuing...

Fedora 43 : stb (2026-0cae436fa5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0cae436fa5 advisory. Patch stbsprintf: security fix for CVE-2026-79516 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

EulerOS Virtualization 2.11.1 : binutils (EulerOS-SA-2026-3403)

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU Binutils thru 2.46 readelf contains a null pointer dereference vulnerability when processing a crafted ELF binary with malform...

Microsoft Edge (Chromium) < 153.0.4234.48 (CVE-2026-88097)

The version of Microsoft Edge installed on the remote Windows host is prior to 153.0.4234.48. It is, therefore, affected by a vulnerability as referenced in the September 18, 2026 advisory. - Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to elevate privileges...

CVE-2024-27123: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later...

PT-2026-95635

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A timing issue, known as a symlink race condition, exists during privileged file operations such as changing file ownership or permissions. A local attacker can manipulate directory...