EUVD-2026-86602

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the ModulaMeta::addmetas function being hooked to wphead on every frontend request and looking up...

OESA-2026-4061 python-templated-dictionary security update

Dictionary where getitem is run through Jinja2 template. Security Fixes: The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of prope...

PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

PT-2026-98358

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient escaping of parameters used in the addresses of links generated on front-end directory pages allows Reflected Cross-Site Scripting XSS. This occurs via the link tags and link price...

PT-2026-98388

Name of the Vulnerable Software and Affected Versions Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.2 Description Unauthenticated attackers can cause the unauthorized disclosure of private gallery contents. The issue occurs because the Modula Meta::add metas function is...

CVE-2026-67226: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...

Linux Distros Unpatched Vulnerability : CVE-2026-67226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

EUVD-2026-84945

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...

Windows Host Security Configuration Reporter

This plugin aggregates Windows host security configuration settings collected by individual detection plugins and reports the result as a structured internal host tag. The structured data object is reported even when only a subset of the source plugins ran. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2026-18153

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...

CVE-2026-18153 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...

CVE-2026-18153

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a flaw where a remote authenticated attacker can obtain sensitive information and forge authentication tags. The root cause is the use of hard-coded cryptographic keys and initialization vectors (IVs) , which are fixed ...

CVE-2026-18153 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and initialization vectors...

PT-2026-97050

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description The admin API contains five authorization issues. A missing await keyword in the POST /api/admin/segments/strategies endpoint allows authenticated users to modify segment assignments without the...

PT-2026-97095

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A remote authenticated attacker could obtain sensitive information and forge authentication tags. This issue is caused by the use of...

CVE-2026-93339 Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...

EUVD-2026-83942

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...

vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature...

CVE-2026-93339: Improper Neutralization of Input During Web Page Generation

Metaphor Creations Ditty ditty-news-ticker before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The...