PT-2026-96725

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp install.log and a named pipe FIFO at /var/log/misp install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

PT-2026-97081

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A local attacker can execute arbitrary commands because the software includes functionality from an untrusted control sphere. Recommendation...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ntfs-3g (UTSA-2022-000915)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000915 advisory. A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the...

Unity Linux 20.1070e Security Update: libxslt (UTSA-2022-001980)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001980 advisory. Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Tenabl...

CVE-2026-18172: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

CVE-2026-95820: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

PT-2026-97025

Name of the Vulnerable Software and Affected Versions GPAC version 2d7da22e 26.08-DEV Description A NULL pointer dereference occurs in the gf sg vrml field clone function when cloning a PROTO default SFImage field with a NULL source pointer. A remote attacker can cause an application crash and...

PT-2026-96854

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.25beta4 Description An improper input validation issue exists in the labelled-VPN NLRI iterators of the routing service. An unauthenticated on-path attacker can crash the BGP service by sending a malformed...

PT-2026-97096

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A remote attacker could obtain sensitive information because the software uses a hard-coded or predictable cryptographic key. Cryptographic...

ROS-20260922-73-0052

The vulnerability of the iscsithandletextcmd function in the drivers/target/iscsi/iscsitarget.c module of the Linux operating system’s TCM driver is related to the execution of operations outside of the buffer. Exploiting this vulnerability could allow a remote attacker to compromise the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebp (UTSA-2023-002880)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002880 advisory. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a...

CVE-2026-37603

The pH7Builder (pH7 Social Dating CMS) software, versions through 19.2.0 , is vulnerable to an improper restriction of excessive authentication attempts in the administration login. The root cause is that the CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled, and the C...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-95671: Missing Authorization

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-17646: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-090031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090031 advisory. Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite...

RockyLinux 8 : apr-util (RLSA-2026:69113)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69113 advisory. apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34501 apr-util: Apache Portable Runtime Utility: Information...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002322)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002322 advisory. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. Tenable has extracted the preceding description block directly from the Unity Linux securi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002313 advisory. Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Tenable has extracted the preceding description block directly from the Unity Linu...

The vulnerability of the isPathAllowedForModule function in the vm2 library of the NPM package manager allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the isPathAllowedForModule function in the vm2 library of the NPM package manager is related to an incorrect restriction on path names for directories. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...