CVE-2026-37072

Veno File Manager Project 4.4.9 contains an Incorrect Access Control vulnerability in admin-head-updates.php. An unauthenticated attacker can exploit a Local File Inclusion flaw in the lang GET parameter by sending a crafted POST request to corrupt the configuration file. A subsequent GET request...

GitLab 18.3 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-4398)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-4398 Note that Nessus has not tested for this issue but has instead relied only on the application'...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

Fedora 43 : libsoup3 (2026-f3ca65c0c9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f3ca65c0c9 advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

SUSE SLES15 Security Update : kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3768-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3768-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.25 fixes various security issues: The following security issues were fixed: -...

TencentOS Server 3: java-21-openjdk (TSSA-2026:0927)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0927 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

UBUNTU-CVE-2023-42179

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to Incorrect A...

CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apac...

CVE-2026-80182

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

CVE-2026-37073

Veno File Manager Project 4.4.9 suffers from an incorrect access control vulnerability in the /vfm-admin/ajax/sendfiles.php endpoint. An unauthenticated attacker can send emails through the application's configured SMTP server by issuing a POST request with the required parameters and headers. Th...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

Linux Distros Unpatched Vulnerability : CVE-2026-81726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on...

PT-2026-82653

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3781-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3781-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: -...

PT-2026-82766

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

PT-2026-82781

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

PT-2026-82799

Name of the Vulnerable Software and Affected Versions Xiiaozet LK100W affected versions not specified Description A critical management function can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. This may permit...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...