PT-2026-2434

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use after free. Improper reference counting on an internal resource caused scenario where potential for use after free was present...

Adobe InDesign Desktop 缓冲区错误漏洞

Adobe InDesign is a professional desktop publishing software developed by Adobe for layout and page layout in print and digital media. A buffer overflow vulnerability exists in Adobe InDesign, which is caused by an access to an uninitialized pointer error, and can be exploited by an attacker to...

Adobe Substance3D Stager 资源管理错误漏洞

Adobe Substance3D Stager is a set and rendering software for 3D scenes from Audobee Adobe USA. A resource management error vulnerability exists in Adobe Substance3D Stager 3.1.5 and prior versions, which stems from reuse after release and could lead to the execution of arbitrary code...

OPENSUSE-SU-2026:10043-1 python311-filelock-3.20.3-1.1 on GA media

These are all security issues fixed in the python311-filelock-3.20.3-1.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-0884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7...

Microsoft Windows SDK < 10.0.26100.7463 Inbox COM Objects (Global Memory) RCE (January 2026)

The version of Microsoft Windows SDK installed on the remote host is prior to 10.0.26100.7463. It is, therefore, affected by a remote code execution vulnerability: - Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. CVE-2026-21219 Note that Nessus has no...

Mediconta 代码问题漏洞

Mediconta is a medical clinic management software by Luis Martinez Personal Developer. A code issue vulnerability exists in Mediconta version 3.7.27, which stems from an unquoted service path that could lead to code execution by a local user with elevated privileges...

SAP S/4HANA Private Cloud and On-Premise SQL注入漏洞

SAP S/4HANA Private Cloud and On-Premise is a service local deployment solution from SAP, Germany. An SQL injection vulnerability exists in SAP S/4HANA Private Cloud and On-Premise that stems from insufficient input validation and could lead to an authenticated user executing a specially crafted...

PT-2026-2806

Name of the Vulnerable Software and Affected Versions Cal.com versions 3.1.6 through 6.0.6 Description Cal.com, an open-source scheduling software, has a critical flaw in a custom NextAuth JWT callback. This issue allows attackers to gain full authenticated access to any user's account by supplyi...

Emerson PAC Machine Edition 代码问题漏洞

Emerson PAC Machine Edition is a development environment software from Emerson USA. A code issue vulnerability exists in Emerson PAC Machine Edition version 9.80, which stems from the presence of unquoted service paths to the TrapiServer service, which could lead to code execution by a local user...

PT-2026-2472

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description Software installed and run as a non-privileged user may conduct improper GPU system calls, leading to mismanagement of resources reference counting and a potential use after free scenario...

MiracleLinux 8 : xmlrpc-c-1.51.0-11.el8_10 (AXSA:2025-9874:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9874:01 advisory. libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2024-8176 Tenable has extracted the preceding description block directly...

MiracleLinux 8 : libxml2-2.9.7-21.el8_10.3 (AXSA:2025-10704:13)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10704:13 advisory. libxml2: Out-of-bounds Read in xmlSchemaIDCFillNodeTables CVE-2025-32415 Tenable has extracted the preceding description block directly from the MiracleLinu...

CVE-2026-22784

Lychee is a free, open-source photo-management tool. Prior to 7.1.0, an authorization vulnerability exists in Lychee's album password unlock functionality that allows users to gain possibly unauthorized access to other users' password-protected albums. When a user unlocks a password-protected...

CVE-2025-40977

Stored Cross-Site Scripting XSS vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters...

Exploit for CVE-2025-68921

CVE-2025-68921 A local privilege escalation vulnerability e...

EUVD-2026-1956

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier...

[SECURITY] Fedora 43 Update: musescore-4.6.5-32.fc43

MuseScore is a free cross platform WYSIWYG music notation program. Some highlights: WYSIWYG, notes are entered on a "virtual note sheet" Unlimited number of staves Up to four voices per staff Easy and fast note entry with mouse, keyboard or MIDI Integrated sequencer and FluidSynth software...

PT-2026-2310

Name of the Vulnerable Software and Affected Versions hermes versions 0.8.1 through 0.9.0 Description hermes, a software publication automation workflow, exhibits a flaw where subcommands accept arbitrary options through the -O argument. Providing sensitive data, such as API tokens e.g., via herm...

PT-2026-4682

Name of the Vulnerable Software and Affected Versions Sangfor Operation and Maintenance Security Management System versions up to 3.0.12 Description A flaw exists in Sangfor Operation and Maintenance Security Management System. The issue is due to command injection within the HTTP POST Request...