CVE-2025-7740

Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment...

CVE-2025-7740 Use of default credentials vulnerability in Hitachi Energy SuprOS product

Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment...

CVE-2025-7740

CVE-2025-7740 describes a default credentials vulnerability in Hitachi Energy SuprOS product. An authenticated local attacker could abuse an admin account created during deployment to gain elevated access. Affected component is SuprOS; CVSSv4.0 vector indicates LOCAL attack with HIGH impact on co...

EUVD-2025-206479

Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created during product deployment...

PT-2026-5084

Name of the Vulnerable Software and Affected Versions SuprOS affected versions not specified Description A default credentials issue exists in SuprOS. Successful exploitation could allow a local attacker with authentication to utilize an administrator account established during product deployment...

CVE-2026-24480

A flaw was found in the QGIS GitHub Actions workflow. This vulnerability allowed a remote attacker to achieve remote code execution and compromise the repository. The flaw occurred because the workflow used the pullrequesttarget trigger, which runs with the base repository's credentials, and then...

CVE-2026-24047

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the resolveSafeChildPath utility function in @backstage/backend-plugin-api, which is...

openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17...

PT-2026-4686

Name of the Vulnerable Software and Affected Versions SoftwareX affected versions not specified Description A logic error exists in the jump to payload function within payload.rs. This issue may result in local information disclosure without requiring additional execution privileges or user...

CVE-2025-69907

An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A remote attacker can access this endpoint without valid credentials to retrieve sensitive internal configuration...

ens-contracts-bug-62248-pr-509

DNS SEC upgrade repo Summary This repo contains the solut...

CVE-2025-69907

An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to a lack of authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A remote attacker can access this endpoint without valid credentials to retrieve sensitive internal configuration in...

CVE-2025-69907

An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCabinet API endpoint. A remote attacker can access this endpoint without valid credentials to retrieve sensitive internal configuration...

PT-2026-4467

Name of the Vulnerable Software and Affected Versions Newgen OmniDocs affected versions not specified Description An unauthenticated information disclosure issue exists in Newgen OmniDocs. The /omnidocs/GetListofCabinet API endpoint lacks proper authentication and access control, allowing an...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to using an image with a metadata.yaml containing templates. An attacker can read or overwrite arbitrary files on the host system, potentially leading to execution of arbitrary commands with elevated privileges, ...

CVE-2026-24006

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in...

Solaris 10 (x86) : 153154-09

The 153154-09 patch has not been applied. The Solaris 10 host is, therefore, affected by the vulnerability as referenced in the 153154-09 patch. SunOS 5.10x86: kernel patch. Date this patch was last updated by Sun : 2026-01-15 Tenable has extracted the preceding description block directly from th...

Improving Methodologies for Agentic Evaluations across Domains: Leakage of Sensitive Information, Fraud and Cybersecurity Threats

The rapid rise of autonomous AI systems and advancements in agent capabilities are introducing new risks due to reduced oversight of real-world interactions. Yet agent testing remains nascent and is still a developing science. As AI agents begin to be deployed globally, it is important that they...

CVE-2026-24046 Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read arbitrary files vi...

CVE-2026-21926

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-25.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment. Successfu...