PT-2026-103685

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-12241: Improper Neutralization of Input During Web Page Generation

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'savemetaboxes' function in all versions up to, and including, 2.51. This makes it possible for authenticat...

CVE-2026-62058: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

PT-2026-103947

Name of the Vulnerable Software and Affected Versions GraphQL Tools versions prior to 1.1.35 Description The buildWSLegacyExecutor function in the executor-legacy-ws module hardcodes the TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allows applications using t...

PT-2026-103706

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an...

CVE-2026-101148: External Control of File Name or Path

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

ROS-20261001-73-0046

The vulnerability in rclone is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-71449: Use of Hard-coded Cryptographic Key

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

PT-2026-103961

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL into the search/listing queries through three separate parameters. Because the affected queries are read SELECT queries, this does not write to the...

CVE-2026-34494: On-Chip Debug and Test Interface With Improper Access Control

On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63...

CVE-2026-96268: Improper Neutralization of Input During Web Page Generation

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

PT-2026-103865

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

PT-2026-105114

phar tar number parses the octal size field of a TAR header into a uint32 t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets...

Rocky Linux 8 [CIQ] Security Update: libluksmeta / libluksmeta-debuginfo / libluksmeta-devel / luksmeta / etc (crlsa-2025_23086)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202523086 advisory. luksmeta: Data corruption when handling LUKS1 partitions with luksmeta CVE-2025-11568 Tenable has extracted the preceding description block directly from the CIQ...

RockyLinux 8 : ruby:2.5 (RLSA-2026:73519)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:73519 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo: MongoDB Ruby Driver: Data...

Rocky Linux 10.1 [CIQ] Security Update: opencryptoki / opencryptoki-ccatok / opencryptoki-ccatok-debuginfo / etc (crlsa-2026_4717)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20264717 advisory. openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following CVE-2026-23893 Tenable has extracted the preceding description block...

AlmaLinux 9.6 [TuxCare] Security Update: java-17-openjdk / java-17-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1785494509)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785494509 advisory. - Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon (ALMALINUX9.2:CLSA-2026:1779438231)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779438231 advisory. - Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is no...

AlmaLinux 9.2 [TuxCare] Security Update: libluksmeta / libluksmeta-devel / luksmeta (ALMALINUX9.2:CLSA-2026:1780411655)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780411655 advisory. - A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker wi...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils (CENTOS6:CLSA-2026:1781169600)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781169600 advisory. - Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache...