CVE-2025-41771

CVE-2025-41771 details an SQL injection vulnerability exploitable by an authenticated user with low privileges via an endpoint in the controller’s web interface. The flaw affects a SQLite database used solely for storing notification messages, so the impact is limited to the system’s notification...

CVE-2025-41771 SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

EUVD-2025-210707

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.52 security and extras update

Red Hat OpenShift Container Platform release 4.18.52 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of Low...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.42 security and extras update

Red Hat OpenShift Container Platform release 4.19.42 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of Low...

GitLab 17.6 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-8667)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19... CVE-2026-8667 Note that Nessus has not tested for this issue but has instead relied only on the...

Fedora 44 : libidn (2026-2291be7d88)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2291be7d88 advisory. Security fix for CVE-2026-57053. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2025-41771: Improper Neutralization of Special Elements used in an SQL Command

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

PT-2026-71115

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2026-14478: Incorrect Permission Assignment for Critical Resource

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability...

CVE-2026-69106: Improper Input Validation

A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...

PT-2026-71195

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged user can poison cached artifact metadata under specific conditions. This action may lead consumers to retrieve untrusted content. Recommendation...

PT-2026-71128

A low-privileged authenticated user may access restricted support information under specific conditions...

PT-2026-71099

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privilege authenticated user can permanently delete protected internal metadata across multiple repositories under specific conditions. Recommendations At...

CVE-2026-66875

The CVE-2026-66875 entry concerns the Mira hormone monitor firmware v1.7.1.47 (build 01070147). A remote unauthenticated attacker within BLE range (≈10–30 m) can: rebind the device to an attacker-controlled account; extract stored hormone measurements in cleartext; cause a denial-of-service via m...

Malicious Package

Overview bjm-low-code-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

CVE-2026-19579

Snipe-IT before 8.6.0 contains an authorization bypass insecure direct object reference in the asset checkout-request cancellation endpoint. The cancelbyadmin and requestingUser values are read from user-controlled URL path segments and used without a server-side authorization check, so any...

CVE-2026-18844

The CVE-2026-18844 entry concerns the Pulsetto Vagus Nerve Stimulator firmware, where several undisclosed commands are accepted over BLE without authentication or encryption and are fully processed when powered on. The connected sources offer no details on affected software versions, specific com...

CVE-2026-73230 Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secrets

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...

CVE-2026-73230

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...