PT-2026-84728

The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users...

PT-2026-84709

A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...

Fedora 44 : emacs (2026-e47f5a0b84)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e47f5a0b84 advisory. Fix CVE-2026-79992: Local shell command injection through the user field in emacs tramp Tenable has extracted the preceding description block directly from t...

SplitView Component Compromise DoS

The vulnerability of the SplitView component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service interruptions through the us...

Autofill Component Data Compromise

The vulnerability of the Autofill component in Google Chrome and Microsoft Edge relates to the user interface’s false representation of critical information. Exploiting this vulnerability can allow a malicious actor to compromise data integrity and also cause service interruptions through the use...

PageInfo Component Compromise Data Compromise

The vulnerability of the PageInfo component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...

CSS components compromise Data Compromise

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...

Extensions Component Data Compromise

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the false representation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-19453: Improper Privilege Management

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...

CVE-2026-45730: Missing Authorization

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user without membership in the target project to bypass OPA authorization checks on write paths P...

PT-2026-84668

Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification...

CVE-2026-84792: Missing Authorization

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...

PT-2026-84898

Name of the Vulnerable Software and Affected Versions Drupal Email Verification / SMS Verification / OTP Verification versions 0.0.0 through 2.4.0 Description An authentication bypass issue exists due to insufficient validation of user-supplied input. This flaw allows an attacker to bypass the...

PT-2026-84899

Name of the Vulnerable Software and Affected Versions Drupal Email Verification / SMS Verification / OTP Verification versions 0.0.0 through 2.4.0 Description An unauthenticated reflected Cross-site Scripting XSS issue exists because the module does not sufficiently filter user-supplied input...

Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting XSS vulnerability...

wget-1.25.0-7.1 on GA media (moderate)

wget-1.25.0-7.1 on GA media Announcement ID: openSUSE-SU-2026:11646-1 Rating: moderate Cross-References: CVE-2026-16599 CVSS scores: CVE-2026-16599 SUSE : 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVE-2026-16599 SUSE : 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N...

Fedora 44 : gdk-pixbuf2 (2026-001de57d4f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-001de57d4f advisory. Fixes https://access.redhat.com/security/cve/CVE-2026-81893 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Email Verification / SMS Verification / OTP Verification - Critical - Access Bypass - SA-CONTRIB-2026-124

This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...

CVE-2026-84479

WWBN AVideo current e01e41ecc and earlier makes three login-time security controls depend solely on the client-supplied User-Agent header. The isAVideoEncoder/isAVideoMobileApp checks match HTTPUSERAGENT against a hardcoded literal "AVideoEncoder"/"AVideoMobileApp" with no IP check or shared...