EUVD-2025-210915

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

CVE-2026-15639

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...

CVE-2026-15640

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

PT-2026-93344

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

PT-2026-94101

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description A stored cross-site scripting issue exists where the unauthenticated endpoint 'objects/videoAddViewCount.json.php' calls the VideoStatistic::save function. This process writes the caller's User-Agent...

CVE-2026-92584: Improper Neutralization of Input During Web Page Generation

AVideo through 29.0 current revision e01e41ecc contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save, which writes the caller's User-Agent via getUserAgentInfo, which returns unrecognized age...

Oracle Linux 8 : tesseract (ELSA-2026-67832)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67832 advisory. 4.1.1-3 - Resolves: CVE-2026-73066 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

Linux Distros Unpatched Vulnerability : CVE-2026-41573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from...

PT-2026-93348

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-73439: Placement of User into Incorrect Group

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule fo...

PT-2026-93315

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

PT-2026-93275

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...

PT-2026-93705

Name of the Vulnerable Software and Affected Versions yshop-crm versions prior to 2.1.4 Description A missing authorization issue exists in the 'GET /admin-api/crm/flow/flow-users' endpoint. This allows any authenticated back-office user to access sensitive approval workflow data, including...

CVE-2026-85385: Improper Neutralization of Input During Web Page Generation

Concrete CMS below 9.5.4 did not validate the user timezone value uTimezone on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field...

PT-2026-93328

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.3 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An authenticated user can induce a targeted user to perform unintended state-changing HTTP requests. This...

CVE-2026-86462: Insufficient Session Expiration

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-8030: Missing Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation o...

CVE-2026-78252: Improper Neutralization of Input During Web Page Generation

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper...

CVE-2026-85572: Exposure of Sensitive Information to an Unauthorized Actor

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...

CVE-2026-74926: Missing Authorization

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it...