Linux Distros Unpatched Vulnerability : CVE-2026-80815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: scarlett2: Use a private URB for the notification endpoint scarlett2initnotify used mixer-urb, which sndusbmixerstatuscreate allocates for the UAC2 status...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

Exploit for SQL Injection in Sangoma Freepbx

CVE-2025-57819 — FreePBX 16 Endpoint Manager unauthenticated S...

GHSA-RGWJ-5XJ2-C3M3 vulnerabilities

Vulnerabilities for packages: sqlpad...

CVE-2024-24919

CVE-2024-24919 Description CVE-2024-24919 is a critical information disclosure vulnerability affecting various Check Point security products, including Quantum Security Gateways and CloudGuard. It has a high CVSS score of 8.6 and allows unauthenticated attackers to read sensitive files from the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073366)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073366 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: check URB actuallength for interrupt-IN notifications USBTMC devices can use an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: etcd (UTSA-2022-001270)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001270 advisory. In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-073352)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-073352 advisory. In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink rmnetdellink removes the endpoi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053227)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053227 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacrubind Syzbot is still reporting quite an old issu...

Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

MAL-2026-15981 Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

CVE-2026-86190

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843 LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint

The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses...

CVE-2026-12843

The LearnDash LMS WordPress plugin is affected by an authorization bypass in versions 4.25.0 through 5.1.6 , caused by improper verification of user authorization via a REST endpoint. Unauthenticated attackers can enroll arbitrary users in paid courses without payment verification, effectively by...

CVE-2026-86174

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

EUVD-2026-71973

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86118

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service ...