EUVD-2026-66200

Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2...

CVE-2026-52473

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges . The vulnerability occurs because the content parameter is directly concatenated to the ProcessBuilder , providing a vector for unauthorized privilege escalation. No specific exploit details, impact assessments, or remedia...

CVE-2026-52473

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder...

Linux Distros Unpatched Vulnerability : CVE-2026-43795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS...

Linux Distros Unpatched Vulnerability : CVE-2026-64781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macO...

Linux Distros Unpatched Vulnerability : CVE-2026-65340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-65336

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-65341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS...

Linux Distros Unpatched Vulnerability : CVE-2026-65334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and...

Linux Distros Unpatched Vulnerability : CVE-2026-64779

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPad...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093164)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093164 advisory. /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Tenable has extracted the preceding description block directly from the Unity Linux...

Linux Distros Unpatched Vulnerability : CVE-2026-65335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-64718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, Safari 27, iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPad...

PT-2026-82136

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the ovpn component when removing a missing key. The function ovpn crypto kill key assumes that both crypto slots are populated and dereferences them before...

Digital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-109

The Digital Signage Framework module provides a route that signage devices can call to refresh dynamic blocks on a display. The route did not check whether the requester was a signage device, nor whether the requested block was one that the module delivers to displays. As a result, an anonymous...

Data field - Moderately critical - Information disclosure - SA-CONTRIB-2026-108

This module enables you to store structured data in configurable fields and expose Data Field values through JSON endpoints. The module doesn't sufficiently check access when returning Data Field values through its JSON endpoint. This may allow anonymous users to access field values belonging to...

Content Moderation Notifications - Moderately critical - Access bypass - SA-CONTRIB-2026-107

The module provides a permission that allows users to configure email templates containing Twig code. This permission was not marked as restricted. A site administrator might inadvertently grant this permission to less-trusted users. This would allow those users to execute Twig within email...

PT-2026-81941

Name of the Vulnerable Software and Affected Versions Katello affected versions not specified Description An authorization flaw exists in the Content View History API. An authenticated user with permissions to view Content Views within one organization can access the lifecycle history of a Conten...

CVE-2026-19094: Improper Neutralization of Special Elements used in an SQL Command

The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly...