223104 matches found
CVE-2026-75166
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...
CVE-2026-75166
MBS-Solutions X-Serie Gateway firmware V6_00_05 contains an insecure permission vulnerability on the /usr/bin/tcpdump binary. A low-privileged service user can execute tcpdump as root without a password, and by leveraging the -z option, an authenticated attacker achieves arbitrary command executi...
PT-2026-85405
The ACPT Premium plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the submit function, which allows unauthenticated form submissions to control the target user ID before calling wp update user. This...
CVE-2026-75160
An issue in X-Serie Gateway Firmware V60005 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi...
Linux Distros Unpatched Vulnerability : CVE-2026-84962
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized...
Debian dla-4770 : firefox-esr - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4770 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4770-1 [email protected]...
CVE-2026-75160
CVE-2026-75160 is a critical remote privilege escalation vulnerability in MBS Solutions X-Serie Gateway running Firmware V6_00_05 . The vulnerability is exploitable via the web endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi, allowing a remote, unauthenticated attacker to escalate priv...
PT-2026-86224
Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem Management interface affected versions not specified Description A missing authorization issue in the management interface allows a user with Admin privileges to escalate their permissions to...
PT-2026-85675
CVE-2026-75160: Critical flaw in X-Serie Gateway Firmware V6 00 05 allows remote privilege escalation via /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. CVSS 9.1. Unpatched—assume exposure. Isolate devices, restrict access, https://t.co/auepElNqKi CVE CVEAlert infosec SysAdmin cybersecurity...
PT-2026-86230
Name of the Vulnerable Software and Affected Versions PassMark PerformanceTest versions prior to 11.1 build 1012 BurnInTest versions prior to 11.1 build 1000 OSForensics versions prior to 11.1 build 1016 Description A privilege escalation issue exists in the DirectIo64.sys driver. Local users can...
PT-2026-86208
CVE-2026-85656: OS command injection in Amazon Linux's log4j hotpatch package 1.3-9. Local user can execute arbitrary commands as root via crafted Java process path with newlines. CVSS 7.8. Unpatched! If you rely on this https://t.co/USqzEPbRQs CVE valtersit CVEAlert infosec SysAdmin cybersecurit...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106179)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106179 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server:...
Fedora 43 : mrtg (2026-4522f50b2c)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4522f50b2c advisory. Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling Tenable has extracted the preceding description block directly from...
CVE-2026-67397
Plesk for Linux versions 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 are affected by a path traversal vulnerability (CVE-2026-67397) that allows local users with low privileges to execute arbitrary code as root . The vulnerability requires local access with low privileges and no user inte...
CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
CVE-2026-14199
On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...
CVE-2026-70178
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...
CVE-2026-70352
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...
