Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099752)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099752 advisory. In the Linux kernel, the following vulnerability has been resolved: comedi: Reinit dev-spinlock between attachments to low-level drivers struct comedidevice is the...

PT-2026-76645

Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-73236

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...

CVE-2026-40126: Improper Neutralization of Input During Web Page Generation

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting XSS attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and...

PT-2026-73340

Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE...

slater v0.25.1

Slater Current version:v0.25.2 — all releases. In one line: Slater serves graphs that don't fit in memory — hundreds of millions of nodes and billions of edges in low hundreds of MB of RAM — over standard Bolt , so any neo4j driver just works, with disk-native vector search sitting next to the...

CVE-2026-16541

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

CVE-2026-19636

The CVE-2026-19636 issue concerns CSRF token generation using a predictable method. The connected documents confirm a fix that increases randomness and entropy in token generation, addressing the vulnerability. The description does not specify affected products, versions, or exploit details. The ...

CVE-2026-63700

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-63700

Dell Wyse Management Suite (WMS) is affected by CVE-2026-63700 in versions prior to 2605.0.2, due to an Incorrect Default Permission issue. The vulnerability could allow a low-privileged attacker with local access to escalate privileges. The available documents confirm affected product (Dell Wyse...

CVE-2026-63700

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

EUVD-2026-58708

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-63701

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

CVE-2026-63702

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-63702

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-72827

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

EUVD-2026-58641

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

PT-2026-71996

Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can inject Twig payloads using the unsandboxed find filter in email subject, body, to, or fro...

SAP NetWeaver AS ABAP Missing Authorization Check (3752864)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3752864: - SAP NetWeaver and ABAP Platform Change and Transport System - Customer Transport Integration Wizard allows a low-privileged use...

EUVD-2026-58528

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...