CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

PT-2026-82088

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.11.0 through 3.17.0 Description An issue exists where the attach-consumer-label plugin fails to correctly sanitize certain input values. This allows an attacker to perform an authorization bypass or escalate privileges...

Ubuntu 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8668-1)

"The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8668-1 advisory. Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations,...

AlmaLinux 9 : firefox (ALSA-2026:58897)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:58897 advisory. firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component CVE-2026-74983 firefox: thunderbird: Site isolation issue in the Graphics:...

attr security update

2.6.0-1 - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr RHEL-186121...

AlmaLinux 10 : attr (ALSA-2026:59380)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59380 advisory. attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 Tenable has extracted the preceding description block directly from the...

PT-2026-82323

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description The S3 API accepts an external OIDC JWT OpenID Connect JSON Web Token sent directly in the Authorization header and maps it to an IAM role without enforcing the trust policy of that role. While the...

Linux Distros Unpatched Vulnerability : CVE-2026-80560

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openrisc: signal: do not restore privileged SR bits on sigreturn restoresigcontext copies the whole supervision register SR from the signal frame and only clea...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: hibernate-validator (UTSA-2026-093593)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093593 advisory. In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access th...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:3683-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3683-1 advisory. Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-74 bsc1274867: - CVE-2026-74934: Site isolation issue in the Graphics:...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)

"The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8663-1 advisory. It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. ...

Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8664-1 advisory. It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use...

CVE-2025-56798

CVE-2025-56798 is a Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology's Unraid OS version 6.12.14 and earlier . The root cause is the Unraid authentication cookie's lax same-site policy , which allows remote attackers to escalate privileges after required user interaction. The CV...

EUVD-2025-210782

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

CVE-2026-52473

CVE-2026-52473 affects Wgcloud 3.6.4 , a web-based application. The root cause is that the content parameter is directly concatenated to a ProcessBuilder , allowing a remote attacker to escalate privileges. The CVSS 3.1 score is 4.3 (MEDIUM) with an adjacent network attack vector, low complexity,...

EUVD-2026-66745

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder...

PT-2026-81929

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2025-70340

CVE-2025-70340 is a Broken Access Control vulnerability in ThingsBoard Professional Edition (PE) 4.21 and below , specifically within the Alarms comments functionality. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments , enabl...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: infinispan (UTSA-2026-032351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032351 advisory. A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private...