Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : BlueZ vulnerabilities (USN-8908-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8908-1 advisory. Michael Bommarito discovered that BlueZ incorrectly handled codec capability storage in the...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : libssh vulnerabilities (USN-8699-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8699-1 advisory. It was discovered that libssh had a stack buffer overflow in its SFTP server when constructing directory listing entries for long...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-8680-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8680-1 advisory. Adrian Junge discovered that FFmpeg incorrectly handled certain subtitle data. An attacker could possibly use this...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : libpng vulnerabilities (USN-8639-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8639-1 advisory. Patrick Keshishian discovered that libpng incorrectly handled certain text chunks. An attacker could...

APSB26-144 : Security update available for Adobe ColdFusion

Adobe has released a priority 2 security update for Adobe ColdFusion. This update addresses vulnerabilities rated critical and high that could result in arbitrary code execution, security feature bypass, arbitrary file system write, privilege escalation, arbitrary file system read, application...

VulnCheck KEV: CVE-2026-10818

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...

VulnCheck KEV: CVE-2026-104935

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands...

VulnCheck KEV: CVE-2026-4885

The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafeajaxformbuilder' function in all versions up to, and including, 7.1.70. The plugin uses an incomplete extension blacklist that only blocks php, phpt,...

VulnCheck KEV: CVE-2024-3242

The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with...

CVE-2026-103966: Heap-based Buffer Overflow

Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8901-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8901-1 advisory. Wander Nauta discovered that Erlang incorrectly handled absolute paths when...

Fortinet FortiManager Multiple Arbitrary File Read/Write via SQLi (FG-IR-26-178)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-26-178 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...

CVE-2026-108381: Improper Control of Generation of Code

dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a...

PT-2026-111580

Name of the Vulnerable Software and Affected Versions AMI APTIOV affected versions not specified Description Local access allows users to trigger a Buffer Access with Incorrect Length Value in the BIOS. This issue can lead to buffer overflows, memory corruption, and arbitrary code execution,...

PT-2026-113278

🚨 CVE-2026-103836 Substance3D - Stager is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 🎖@cveNotify...

PT-2026-111818

Name of the Vulnerable Software and Affected Versions Shopware version 6.7 Description Shopware allows the upload of attacker-controlled HTML files which are served as text/html without effective security headers, such as Content-Security-Policy or X-Content-Type-Options: nosniff. This leads to...

Siemens SIMATIC S7 Webserver API

SUMMARY .NET Client Library for SIMATIC S7 Webserver API contains multiple vulnerabilities that could allow an attacker to obtain sensitive information or write arbitrary files outside the intended download directory. Siemens has released a new version for .NET Client Library for SIMATIC S7...

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands...

Siemens RUGGEDCOM CROSSBOW Station Access Controller

SUMMARY RUGGEDCOM CROSSBOW Station Access Controller SAC contains multiple vulnerabilities in the integrated SQLite component that could allow an attacker to execute arbitrary code, cause a denial of service, or obtain sensitive information. Siemens has released a new version for RUGGEDCOM...

PT-2026-111390

Name of the Vulnerable Software and Affected Versions Industrial Edge App Publisher versions prior to V1.27.9 Description The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Due to the front end integration with Node.js,...