CVE-2026-2388: Improper Neutralization of Input During Web Page Generation

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

Linux Distros Unpatched Vulnerability : CVE-2026-79146

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

PT-2026-82066

Name of the Vulnerable Software and Affected Versions TarsWeb affected versions not specified Description Improper authorization occurs because four methods in app/controller/patch/PatchController.js fail to call the AuthService to enforce per-application roles. This allows any authenticated user...

Linux Distros Unpatched Vulnerability : CVE-2026-79258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cross-origin data via...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...

RHEL 8 : go-toolset:rhel8 (RHSA-2026:60305)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60305 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: encoding/asn1:...

Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Slick UI, a sub-module of Slick, enables you to add Slick option sets that may contain HTML for carousel buttons. Previous releases of the module did not sufficiently validate user input, leading to a Cross Site Scripting XSS vulnerability. Note: This vulnerability was fixed in 8.x-2.1 but that w...

RockyLinux 9 : golang (RLSA-2026:22121)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22121 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

RHEL 9 : golang (RHSA-2026:60304)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60304 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servic...

RockyLinux 10 : golang (RLSA-2026:22120)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22120 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:22112)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22112 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-78958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104551)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104551 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ip6gre: require CAPNETADMIN in the device netns for changelink ip6grechangelink and...

Linux Distros Unpatched Vulnerability : CVE-2026-79144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium securit...

RHEL 10 : golang (RHSA-2026:60306)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60306 advisory. The golang packages provide the Go programming language compiler. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Servi...

Linux Distros Unpatched Vulnerability : CVE-2026-79118

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-78965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093193 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Tenable has extracted the preceding...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...