PT-2026-82316

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

PT-2026-82368

Name of the Vulnerable Software and Affected Versions Drupal Blazy versions 0.0.0 through 3.0.18 Description An incorrect authorization issue allows forceful browsing. The module enables users to display a field of a target entity using a Blazy Filter plugin shortcode. Because the module does not...

PT-2026-82256

Name of the Vulnerable Software and Affected Versions Dell Cloud Disaster Recovery versions prior to 20.3 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A high privileged attacker with remote access could exploit this fla...

PT-2026-82314

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated reflected Cross-Site Scripting XSS issue exists in the user activation confirmation endpoint. The action query parameter is copied into the response and inserted into a...

PT-2026-82047

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description Broken access control allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations hosted on the same instance. Additionally, an...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098668)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098668 advisory. Uncontrolled resource consumption in the Linux kernel drivers for IntelR SGX may allow an authenticated user to potentially enable denial of service via local access...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql5 (UTSA-2026-093676)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093676 advisory. Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.50 and prior, 5.7.32 and prior and 8.0.22 an...

Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot’s secret delete key using only its public share key broken access control...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098727)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098727 advisory. In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this...

SUSE SLES15 Security Update : kernel RT (Live Patch 16 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:3700-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3700-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.59 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-79213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions v...

PT-2026-82334

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.1 Description Cluster-scoped APIs do not consistently validate per-cluster access. This allows an authenticated user with cluster management permissions to operate on clusters outside their granted scope. Because t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: targetcli (UTSA-2026-093622)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093622 advisory. Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target and for the backup directory and backup files. Tenable has extracted the preceding...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098974)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098974 advisory. In the Linux kernel, the following vulnerability has been resolved: mpls: add seqcount to protect the platformlabel,s pair The RCU-protected codepaths mplsforward,...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

Linux Distros Unpatched Vulnerability : CVE-2026-79259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-79776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can...