EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-37073

Incorrect access control in /vfm-admin/ajax/sendfiles.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to send emails from the configured SMPT server on the application via making a POST request to the endpoint with needed parameters and header...

PT-2026-82730

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An unauthenticated user can execute arbitrary SQL statements against the underlying database of the ServiceNow AI platform. This occurs via a SQL injection in the dynamic schem...

PT-2026-82778

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...

CVE-2026-37072

Veno File Manager Project 4.4.9 is vulnerable to an Incorrect Access Control flaw in admin-head-updates.php, specifically a Local File Inclusion via the lang GET parameter. An unauthenticated attacker can send a specially crafted POST request to corrupt the configuration file, then hit the setup ...

CVE-2026-37070

Veno File Manager 4.4.9 contains an incorrect access control flaw in /vfm-admin/ajax/streamvid.php. An authenticated attacker who knows the path and filename of a file uploaded by another user can read it via a specially crafted GET request to the affected endpoint. The CVSS 3.1 score is 6.5 (Med...

CVE-2026-37070

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

GitLab 18.3 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-4398)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-4398 Note that Nessus has not tested for this issue but has instead relied only on the application'...

PT-2026-82736

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different...

Fedora 43 : libsoup3 (2026-f3ca65c0c9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f3ca65c0c9 advisory. Fix for several CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

PT-2026-82780

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M affected versions not specified Description The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an...

SUSE SLES15 Security Update : kernel (Live Patch 7 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3768-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3768-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.25 fixes various security issues: The following security issues were fixed: -...

PT-2026-82793

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

TencentOS Server 3: java-21-openjdk (TSSA-2026:0927)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0927 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-82799

Name of the Vulnerable Software and Affected Versions Xiiaozet LK100W affected versions not specified Description A critical management function can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. This may permit...

CVE-2026-36102

An issue in the inviteController.js component in Bluewave Labs Checkmate =3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint...

PT-2026-82787

go-wind-cms GoWind before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine noop.State, so the authz middleware always allows requests. Any...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-75337

Yu AI Code Mother v4.3 is vulnerable to path traversal in its static resource interface /api/static/{deployKey}/. The user-controlled path is concatenated to the preview root directory without normalization , allowing anonymous attackers to read files outside the intended directory. The vulnerabi...

PT-2026-82591

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description A symlink-following flaw exists in the verify-usb v2 added-file allowlist scan. The scan uses the rglob function, which in CPython does not descend into symlinked directories and treats the...