PT-2026-60394

Name of the Vulnerable Software and Affected Versions Zoom Rooms for Windows versions prior to 7.1.0 Description Improper privilege management allows an authenticated user to perform an escalation of privilege through local access. Recommendations Update Zoom Rooms for Windows to version 7.1.0 or...

PT-2026-60223

Name of the Vulnerable Software and Affected Versions Cisco RoomOS affected versions not specified Description An issue exists involving improper control of a resource through its lifetime. A remote attacker could exploit this flaw to cause a denial of service DoS, which is a condition where a...

PT-2026-60221

Name of the Vulnerable Software and Affected Versions Cisco RoomOS affected versions not specified Description Multiple issues exist due to improper restriction of operations within the bounds of a memory buffer. This memory buffer overflow could allow a remote attacker to execute arbitrary code ...

PT-2026-60220

Name of the Vulnerable Software and Affected Versions Cisco RoomOS affected versions not specified Description Cisco RoomOS contains multiple issues related to improper input validation. A remote attacker could exploit these flaws to cause a denial of service DoS, which is a condition where the...

PT-2026-60212

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser can leave a public directory share behind when the shared directory is deleted through a path with a trailing slash because the...

PT-2026-60311

Name of the Vulnerable Software and Affected Versions xszyou Fay version 4.3.1 Description Remote code execution is possible via the MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface to configure an MCP STDIO...

The vulnerability of the software for interacting with servers via cURL, related to errors in the certificate validation process, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the software for interacting with servers via cURL is related to errors in the certificate validation process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

(Pwn2Own) Autel MaxiCharger AC Elite Home Software Update Improper Verification of Cryptographic Signature Arbitrary Code Execution Vulnerability

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of software updates. The issue...

Oracle Linux 10 : grafana (ELSA-2026-19027)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-19027 advisory. 10.2.6-25 - Resolves RHEL-158484: CVE-2026-25679 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

UBUNTU-CVE-2026-46640

Twig is a template language for PHP. From 3.15.0 until 3.26.0, self. and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and...

JLSEC-2026-718 Heap buffer overflow in DTLS 1.3 ACK message processing

Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow...

CVE-2026-48311

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48816

CVE-2026-48816 affects sigstore-js, where prior to version 3.1.1 the verification logic in @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries, even though the inclusion proof path does not cryptographically bind inte...

CVE-2026-48347

Animate is affected by an OS Command Injection (CWE-78) due to improper neutralization of special elements in an input that is used in an OS command. This can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malici...

CVE-2026-48350 Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to access sensitive files or directories outside the...

@blumintinc/eslint-plugin-blumint (>=1.3.0, <=1.23.0), @eeacms/volto-cca-policy (>=0.1.17, <=1.0.37) +35 more potentially affected by CVE-2026-15699 via compromise (>=14.0.0, <=14.15.1)

compromise NPM version =14.0.0, =1.3.0, =0.1.17, =1.1.236, =0.1.1, =1.0.12, =4.0.2, =0.1.16, =0.1.14, =0.1.3, =0.1.29, =3.0.1, =0.1.0, =3.0.3, =0.1.4, =2.0.0-alpha.1, =2.2.0 and more Source cves: CVE-2026-15699 Source advisory: SNYK:JS-COMPROMISE-17972425...

globaleaks-whistleblowing-software v5.0.98

GlobaLeaks is free and open-source whistleblowing software enabling anyone to easily set up and...

EUVD-2026-44329

A security flaw was discovered in the NETGEAR DGND3700v1 that could allow someone on the same local WiFi network to send unauthorized commands to the device. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has n...

EUVD-2026-44323

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives mat...

CVE-2026-0515 Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Insufficient Parameter Validation in the SchedGet system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel...