151597 matches found
VulnCheck KEV: CVE-2026-84755
Unauthenticated Broken Access Control in Mail Mint = 1.31.0 versions...
Next.js Framework 13.4 < 15.5.24 / 16.x < 16.3.3 RCE (Windows)
The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - A vulnerability in applications using both the Pages Router and App Router without Cache Components can lead to unauthenticated remote code execution when the Next.js server uses a Windows filesystem...
Linux Distros Unpatched Vulnerability : CVE-2026-70399
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servic...
Linux Distros Unpatched Vulnerability : CVE-2026-65107
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix sbcast shared objects skipping credential verification, Fix possible slurmd crash on invalid sbcast filenames...
...[ More ]
This Metasploit module exploits an unauthenticated command execution vulnerability in MCPJam Inspector. The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and argument list used to start an MCP server. A remote attacker can abuse this endpoint to execute arbitra...
PT-2026-85316
Name of the Vulnerable Software and Affected Versions ConfigServer Security & Firewall versions prior to 16.31 Description An insecure Apache configuration maps /usr/bin as CGI Common Gateway Interface programs through the Messenger v3 HTTPS virtual host. This allows a remote unauthenticated...
VMware Workstation 25H2, 26H1.x < 26H1u1 Multiple Vulnerabilities (VMSA-2026-0007)
The version of VMware Workstation installed on the remote host is 25H2, 26H1.x prior to 26H1u1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 809...
Linux Distros Unpatched Vulnerability : CVE-2026-65108
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable CVE-2026-65108...
Oracle Linux 8 : ELSA-2026-61257-0: / iperf3 (ELSA-2026-612570)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-612570 advisory. 3.5-12.1 - Resolves: RHEL-236174 - Add JSON value checks for getparameters CVE-2026-71217 Tenable has extracted the preceding description block directly from...
PT-2026-85122
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-52132
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service std::badalloc and HTTP 500 via a...
PT-2026-85102
A critical security vulnerability was found in the LiteSpeed Cache plugin for WordPress, and you really need to patch it right now. This flaw, tracked as CVE-2026-84761 with a high severity rating of 7.2, lets unauthenticated hackers pull off Server-Side Request Forgery attacks. Basically, anyone...
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Summary The OpenChoreo autobuild webhook endpoint POST /api/v1alpha1/autobuild selected the git provider used to authenticate an incoming webhook from a client-supplied request header rather than from the target component's configuration, and its Bitbucket provider accepted requests without a val...
GHSA-C5F6-2RM9-2W8G OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)
Summary The OpenChoreo autobuild webhook endpoint POST /api/v1alpha1/autobuild selected the git provider used to authenticate an incoming webhook from a client-supplied request header rather than from the target component's configuration, and its Bitbucket provider accepted requests without a val...
EUVD-2026-58546
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion webhook signature bypass...
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...
EUVD-2026-58518
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs...
GHSA-QH9R-J7RP-4X2M OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Summary The OpenChoreo control-plane cluster-gateway served its caller-facing management APIs on the same network listener that accepts data-plane agent connections. In the multi-cluster topology that listener is published outside the cluster, and the management APIs did not authenticate the...