PT-2026-97081

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A local attacker can execute arbitrary commands because the software includes functionality from an untrusted control sphere. Recommendation...

CVE-2026-76708: Use of Hard-coded Credentials

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

PT-2026-97129

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0 Description OpenBao is an identity-based secrets management system. The handleLogicalRecovery function in the http/logical.go file uses ordinary string equality to compare the highly privileged recovery token. A...

CVE-2026-77555: Out-of-bounds Write

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77544: Out-of-bounds Write

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-17102: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-090031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090031 advisory. Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite...

PT-2026-97105

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Remote attackers could obtain sensitive information because the software transmits sensitive data in cleartext, which is unencrypted data se...

PT-2026-97025

Name of the Vulnerable Software and Affected Versions GPAC version 2d7da22e 26.08-DEV Description A NULL pointer dereference occurs in the gf sg vrml field clone function when cloning a PROTO default SFImage field with a NULL source pointer. A remote attacker can cause an application crash and...

CVE-2026-37603

The pH7Builder (pH7 Social Dating CMS) software, versions through 19.2.0 , is vulnerable to an improper restriction of excessive authentication attempts in the administration login. The root cause is that the CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled, and the C...

CVE-2026-95656: Server-Side Request Forgery (SSRF)

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

The vulnerability of the Scripting components of the Oracle Java SE software platform allows attackers to gain unauthorized access to protected information.

The vulnerability of Oracle Java SE’s scripting components is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002313 advisory. Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Tenable has extracted the preceding description block directly from the Unity Linu...

RockyLinux 8 : apr-util (RLSA-2026:69113)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69113 advisory. apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34501 apr-util: Apache Portable Runtime Utility: Information...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002322)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002322 advisory. Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. Tenable has extracted the preceding description block directly from the Unity Linux securi...

The vulnerability of the isPathAllowedForModule function in the vm2 library of the NPM package manager allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the isPathAllowedForModule function in the vm2 library of the NPM package manager is related to an incorrect restriction on path names for directories. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: clamav (UTSA-2023-002120)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002120 advisory. A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated, remote attacker to cause a denial of...

Unity Linux 20.1070e Security Update: libxslt (UTSA-2022-001980)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001980 advisory. Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Tenabl...

CVE-2026-95671: Missing Authorization

In MISP, the CollectionsController add method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add method persists data on both POST and PUT requests. As a result, an authenticated user...

CVE-2026-13355: Improper Privilege Management

The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populateviaquerystring function in the mb-frontend-submission component unconditionally overrides the form's target objectid fr...