CVE-2026-75743 Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352)

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to...

CVE-2026-95805 MISP ACLComponent: Typo in previewEventAttributes ACL key bypasses intended access restriction

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themingenabled' with a trailing asterisk instead of the correct 'themingenabled'. In the MISP ACL system, the array values define which role o...

CVE-2026-95674 MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation

In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued processing using default parameters format s...

EUVD-2026-84296

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

CVE-2026-93952: Improper Input Validation

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

PT-2026-96680

Name of the Vulnerable Software and Affected Versions VeloCloud Orchestrator versions 5.2.0 through 5.2.3.15 VeloCloud Orchestrator versions 6.1.0 through 6.1.3.7 VeloCloud Orchestrator versions 6.4.0 through 6.4.2.7 VeloCloud Orchestrator versions 7.0.0 through 7.0.0.2 Description An improper...

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

PT-2026-96989

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description Cross-Site Request Forgery CSRF is a flaw where a victim is tricked into performing actions they did not intend to do. This issue allows an attacker to bypass...

Slackware Linux 15.0 / current util-linux Vulnerability (SSA:2026-264-01)

The version of util-linux installed on the remote host is prior to 2.42.4. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-264-01 advisory. New util-linux packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the precedin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000533)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000533 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959. Tenable has extracted the preceding description block directly from the Unity Linux security...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ghostscript (UTSA-2026-090666)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090666 advisory. A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allow...

PT-2026-96785

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A typo in the ACLComponent access control configuration causes the ACL rule for the previewEventAttributes action to reference the permission string theming enabled instead of theming enabled...

VulnCheck KEV: CVE-2026-93952

Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

PT-2026-96728

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description The queryEnrichment function in EventsController.php fails to properly validate the module name parameter. When a module name is provided that is not in the list of enabled modules, the system...

kyverno-1.19.1-1.1 on GA media (moderate)

kyverno-1.19.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11822-1 Rating: moderate Cross-References: CVE-2026-39821 CVE-2026-56853 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1...

SUSE CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

CVE-2026-83621

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

EUVD-2026-83983

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/editblacklist.lua in scripts/lua/rest/v2/edit/system/editblacklist.lua lacks an administrator check and calls listsutils.editList for any authenticated user. The listname, listenabled,...

Linux Distros Unpatched Vulnerability : CVE-2026-91203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged fi...

Linux Distros Unpatched Vulnerability : CVE-2026-93586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated...