Tenable Sensor Proxy < 1.4.2 Code Injection (TNS-2026-21)

According to its self-reported version, the Tenable Sensor Proxy running on the remote host is prior to 1.4.2. It is, therefore, affected by code injection vulnerability as referenced in the TNS-2026-21 advisory. - A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code...

CVE-2026-67687

The CVE-2026-67687 case concerns ICS-Park Smart Park Management System v2.0 (based on RuoYi). A vertical privilege escalation exists via missing authorization checks in two endpoints: /system/role/save (RoleController.java) and /system/user/update (UserController.java). An authenticated low-privi...

CVE-2026-67689

CVE-2026-67689 concerns FineAdmin V1.0 where the vulnerability arises in the paginated list endpoints through the field and order parameters, enabling SQL injection via unsafely constructed ORDER BY clauses. Connected sources describe that FineAdmin.Mvc’s GetListByFilter()/GetPageUnite() concaten...

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the file upload module. This allows a remote attacker to execute arbitrary code...

CVE-2026-67688

ICS-Park Smart Park Management System v2.0 is affected by an unrestricted file upload vulnerability in the file upload module, enabling a remote attacker to upload arbitrary files and potentially achieve remote code execution. The CVE entry rates this as CRITICAL (CVSS 3.1: 9.8) with network acce...

RHEL 9 : systemd (RHSA-2026:51134)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51134 advisory. The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive...

EulerOS 2.0 SP13 : samba (EulerOS-SA-2026-2998)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

Schneider Electric SCADAPack and RemoteConnect Improper Check For Unusual or Exceptional Conditions (CVE-2026-0667)

CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause remote code execution, denial of service, and loss of confidentiality and integrity of the RTU controller when an unauthenticated attacker sends specially crafted Modbus TCP packets to the device...

Malicious code in svelte-mapping-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76203390ecd481ea969ede1996712ca380655fb041c051d50696b2f8f3dd9265 No a static rule matches and no traced code paths indicating credential access, exfiltration, install-time remote code execution, silent-relay,...

CVE-2026-18970 Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

CVE-2026-18970

A flaw has been found in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. The affected element is an unknown function of the file /dm/dispatch/user/findAll. Executing a manipulation of the argument Name can lead to sql injection. It is possible to launch the attack...

CVE-2026-18970

CVE-2026-18970 affects Rongzhitong Visual Integrated Command and Dispatch Platform (

CVE-2026-18969

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

CVE-2026-18969 Rongzhitong Visual Integrated Command and Dispatch Platform upload unrestricted upload

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attac...

CVE-2026-18969

CVE-2026-18969 – Rongzhitong Visual Integrated Command and Dispatch Platform A vulnerability exists in the file upload path /dm/dispatch/userinfo/upload where argument manipulation of the File parameter enables unrestricted uploads. This could allow remote initiation of an attack with no required...

DEBIAN-CVE-2026-67863

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UASubscriptionlocalPublish continues to use the current UANotification after a callback invokes UAServerdeleteMonitoredItem for the current local MonitoredItem. This allows a...

CVE-2026-67867

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data...

CVE-2026-18968 ttttonyhe OBlog tags.php cross site scripting

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

CVE-2026-18968

CVE-2026-18968 affects ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. The vulnerability is in processing of the file /tags.php where manipulation of the day argument enables cross site scripting. The attack could be performed remotely, and the exploit has been publicly disclosed....