CVE-2026-79898: Improper Neutralization of Special Elements used in an OS Command

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...

CVE-2026-86610: Improper Neutralization of Input During Web Page Generation

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-97281: Missing Authorization

Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...

CVE-2026-89427: Improper Neutralization of Input During Web Page Generation

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-105811

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

PT-2026-103767

Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...

CVE-2026-64947: Unrestricted Upload of File with Dangerous Type

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the application software interface of the Cisco Catalyst SD-WAN Manager is related to improper handling of data with encoded URLs. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and gain unauthorized access to protected information by...

Linux Distros Unpatched Vulnerability : CVE-2026-102587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges...

CVE-2026-64950: Improper Neutralization of Input During Web Page Generation

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-79896: Out-of-bounds Read

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...

Rocky Linux 9 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource Multiple Vulnerabilities (crlsa-2024_4861)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20244861 advisory. squid: vulnerable to a Denial of Service attack against Cache Manager error responses CVE-2024-23638 squid: Out-of-bounds write error may lead to Denial of...

CentOS Linux 8.4 [TuxCare] Security Update: systemd / systemd-container / systemd-devel / etc (CENTOS8.4:CLSA-2026:1784813597)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784813597 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...

Linux Distros Unpatched Vulnerability : CVE-2026-47503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager vGPU plugin, where a guest VM user may cause an out-of-bounds write by...

Rocky Linux 8 [CIQ] Security Update: dnf-plugin-subscription-manager / etc (crlsa-2023_4706)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234706 advisory. subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration CVE-2023-3899 Tenable has extracted th...

CentOS Linux 6 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777446517)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777446517 advisory. - An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains ...

AlmaLinux 9.2 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1736860159)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736860159 advisory. - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denia...

Rocky Linux 8 [CIQ] Security Update: 389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc Multiple Vulnerabilities (crlsa-2026_64791)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202664791 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...

Rocky Linux 8.6 [CIQ] Security Update: dnf-plugin-subscription-manager / etc (ciqsa-2026_0033)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260033 advisory. This advisory aggregates security fixes for the subscription-manager SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2023-3899. Tenable has extracted the preceding...

Rocky Linux 10.2 [CIQ] Security Update: yggdrasil-worker-package-manager / etc Multiple Vulnerabilities (crlsa-2026_69099)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of...