Fedora 43 : libsoup3 (2026-f3ca65c0c9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f3ca65c0c9 advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Linux Distros Unpatched Vulnerability : CVE-2026-81726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

PT-2026-82766

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one appliances SV-100E and SV-300E series and Synergis Softwire installed on Windows servers...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

PT-2026-82781

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication o...

PT-2026-82799

Name of the Vulnerable Software and Affected Versions Xiiaozet LK100W affected versions not specified Description A critical management function can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. This may permit...

CVE-2026-75337

Yu AI Code Mother v4.3 is vulnerable to path traversal in its static resource interface /api/static/{deployKey}/. The user-controlled path is concatenated to the preview root directory without normalization , allowing anonymous attackers to read files outside the intended directory. The vulnerabi...

PT-2026-82591

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description A symlink-following flaw exists in the verify-usb v2 added-file allowlist scan. The scan uses the rglob function, which in CPython does not descend into symlinked directories and treats the...

PT-2026-82653

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ...

CVE-2026-65182

Improper Access Control, Incorrect Authorization vulnerability in Apac...

CVE-2026-80182

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access...

CVE-2026-37073

Veno File Manager Project 4.4.9 suffers from an incorrect access control vulnerability in the /vfm-admin/ajax/sendfiles.php endpoint. An unauthenticated attacker can send emails through the application's configured SMTP server by issuing a POST request with the required parameters and headers. Th...

CVE-2026-37068

An arbitrary file write vulnerability in Veno File Manager Project 4.4.9 affects the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can overwrite any PHP file in the application by sending a specially crafted POST reque...

CVE-2026-79201

Improper access control in Workers in Google Chrome prior to 152.0.797...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

PT-2026-82794

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82649

Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description An eval injection a...

SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3781-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3781-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: -...