RHEL 9 : pcre2 (RHSA-2026:82845)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82845 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern...

Copeland XWEB and XWEB Pro Improper Limitation of a Pathname to a Restricted Directory (CVE-2026-22877)

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack. This plugin only works with Tenable.ot. Please visit...

Linux Distros Unpatched Vulnerability : CVE-2026-110154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Canvas in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-110147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Adobe Photoshop 26.x < 26.11.8 / 27.x < 27.11 Multiple Vulnerabilities (macOS APSB26-158)

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 26.11.8/27.11. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-158 advisory. - Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result i...

PT-2026-113713

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the ' type e.g. foo type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : FFmpeg vulnerabilities (USN-8915-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8915-1 advisory. Momoko Shiraishi discovered that FFmpeg did not correctly handle certain memory operations. A...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130131)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130131 advisory. rsyncbefore 3.5.0contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting...

PT-2026-113620

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage function. This is due to the startSession function accepting an empty jtlauth parameter as a valid credential, combined with insufficient fil...

PT-2026-113659

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

ROS-20261014-73-0228

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261014-73-0220

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261014-73-0230

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261014-73-0178

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-113889

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS affected versions not specified Juniper Networks Junos OS Evolved affected versions not specified Description A stack-based buffer overflow occurs in the l2cpd process. This issue allows an adjacent unauthenticated...

PT-2026-113652

Akamai GPA Guardicore Platform Agent client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in...

PT-2026-113901

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS...

PT-2026-113693

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

PT-2026-113681

The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server...

PT-2026-113722

Name of the Vulnerable Software and Affected Versions AmazonPay Plugin for EC-CUBE 4 series affected versions not specified Description An issue exists where an assumed-immutable web parameter is under external control. This allows an attacker to redirect users to an arbitrary website during the...