EUVD-2026-66764

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

GeckoDroid

GeckoDroid Client mobile per Adaptix C2 Framework. Accesso completo dell'operatore dal tuo dispositivo Android. Cosa fa GeckoDroid ti dà il controllo del tuo server Adaptix C2 da qualsiasi luogo. Invece di stare seduto al tuo client desktop, puoi gestire le operazioni in movimento. Agenti - Vedi...

Blackash-CVE-2025-33073

✨ CVE-2025-33073: Windows SMB RCE 취약점 🚨 🔥 높은 심각도의 인증된 원격 코드 실행 🔥 Windows SMB 클라이언트의 부적절한 접근 제어 CWE-284 🛡️ 주요 정보 요약...

PT-2026-82780

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M affected versions not specified Description The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82793

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-75337

The static resource interface /api/static/deployKey/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root...

PT-2026-82571

Name of the Vulnerable Software and Affected Versions Telnyx MCP server affected versions not specified Description The HTTP transport was exposed on all network interfaces and did not require caller credentials. In the file packages/mcp-server/src/http.ts, the server served the Model Context...

PT-2026-82778

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

PT-2026-82789

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

PT-2026-82730

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An unauthenticated user can execute arbitrary SQL statements against the underlying database of the ServiceNow AI platform. This occurs via a SQL injection in the dynamic schem...

PT-2026-82736

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

CVE-2026-37070

CVE-2026-37070 affects Veno File Manager Project 4.4.9 due to an incorrect access control flaw in the /vfm-admin/ajax/streamvid.php endpoint. An authenticated attacker who knows the path and filename of another user's uploaded file can retrieve it via a specially crafted GET request , resulting i...

CVE-2026-37072

Veno File Manager Project 4.4.9 contains an Incorrect Access Control vulnerability in admin-head-updates.php. An unauthenticated attacker can exploit a Local File Inclusion flaw in the lang GET parameter by sending a crafted POST request to corrupt the configuration file. A subsequent GET request...

CVE-2026-79674

NLTK versions before 3.10.3 contain a path sandbox bypass vulnerabilit...

CVE-2026-78892

Incorrect authorization in Chromoting in Google Chrome on on Windows p...

GitLab 18.3 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-4398)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-4398 Note that Nessus has not tested for this issue but has instead relied only on the application'...

Fedora 43 : libsoup3 (2026-f3ca65c0c9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f3ca65c0c9 advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

PT-2026-82450

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.11.0 through 3.17.0 Description An LDAP Injection occurs due to improper neutralization of special elements used in an LDAP query. This allows a caller with valid credentials for one LDAP directory entry to authenticat...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...