PT-2026-3664

Name of the Vulnerable Software and Affected Versions poplib affected versions not specified Description The poplib module is susceptible to command injection when processing user-supplied commands. Specifically, the module can be exploited to inject additional commands through the use of newline...

CVE-2025-24531

In OpenSC pampkcs11 before 0.6.13, pamsmauthenticate wrongly returns PAMIGNORE in many error situations such as an error triggered by a smartcard before login, allowing authentication bypass...

CVE-2025-24531

In OpenSC pampkcs11 before 0.6.13, pamsmauthenticate wrongly returns PAMIGNORE in many error situations such as an error triggered by a smartcard before login, allowing authentication bypass...

MiracleLinux 4 : httpd-2.2.15-31.0.1.AXS4 (AXSA:2014-468:02)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-468:02 advisory. Description : The Apache HTTP Server is a powerful, efficient, and extensible web server. Security issues fixed with this release: CVE-2014-0118 The...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004189)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004189 advisory. In the Linux kernel before 4.20.12, net/ipv4/netfilter/nfnatsnmpbasicmain.c in the SNMP NAT module has insufficient ASN.1 length checks aka an array index error,...

MiracleLinux 3 : krb5-1.6.1-80.AXS3 (AXSA:2014-537:02)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2014-537:02 advisory. Description : Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practi...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004422)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004422 advisory. In the Linux kernel before 5.1.6, there is a use-after-free in serialirinitmodule in drivers/media/rc/serialir.c. Tenable has extracted the preceding description blo...

MiracleLinux 4 : nss-util-3.14.3-3.AXS4, nss-softokn-3.14.3-3.AXS4, nspr-4.9.5-2.AXS4, nss-3.14.3-4.0.1.AXS4 (AXSA:2013-618:04)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-618:04 advisory. nss: Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server...

MiracleLinux 4 : kernel-2.6.32-642.4.2.el6 (AXSA:2016-679:07)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2016-679:07 advisory. The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the operating system:...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003845)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003845 advisory. gssmechfree in net/sunrpc/authgss/gssmechswitch.c in the rpcsecgsskrb5 implementation in the Linux kernel through 5.6.10 lacks certain domainrelease calls, leading t...

CVE-2025-34442

creationtimestamp| type| source ---|---|--- 2026-01-15 23:54:26+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/avideonotifyffmpegunauthrce.rb 2026-01-16 21:03:03+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mckypdx2ay22...

CVE-2021-47779

Dolibarr ERP-CRM 14.0.2 is affected by a stored cross-site scripting (XSS) vulnerability in the ticket creation module. The issue allows a low-privilege user to inject JavaScript that can be executed when an administrator copies the crafted ticket text, with potential privilege escalation. Techni...

CVE-2026-21917

An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX device configured for UTM Web-Filtering receives a specifical...

CVE-2025-70892

Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint...

EUVD-2026-2685

An Unchecked Return Value vulnerability in the DNS module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX Series device configured for DNS processing, receives a specifically formatted DNS request flowd will...

CVE-2026-21917 Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crash

An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX device configured for UTM Web-Filtering receives a specifical...

CVE-2026-21917 Junos OS: SRX Series: Specifically malformed SSL packet causes FPC crash

An Improper Validation of Syntactic Correctness of Input vulnerability in the Web-Filtering module of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. If an SRX device configured for UTM Web-Filtering receives a specifical...

Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode

Severity: LOW Target: /workspace/pepr/src/lib/assets/rbac.ts Endpoint: Kubernetes RBAC configuration Method: Deployment Response / Rationale Pepr defaults to rbacMode: "admin" because the initial experience is designed to be frictionless for new users. This mode ensures that users can deploy and...

CVE-2026-22265 Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py...

CVE-2021-47769

Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent...