PT-2026-79494

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, authentication bypass allows unauthenticated remote attackers to execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment. This issue has been fixed in version 3.2.3...

Fedora 44 : wordpress (2026-dc0ff85b8b)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dc0ff85b8b advisory. WordPress 6.9.7 Release Security update included in this release - Authenticated Author+ remote code execution via malicious file upload on sites th...

PT-2026-79469

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12...

AIX : Multiple Vulnerabilities (IJ59563)

The version of AIX installed on the remote host is prior to APAR IJ59563. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59563 advisory. - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in...

...[ More ]

Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...

Linux Distros Unpatched Vulnerability : CVE-2026-18306

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GIMP SGI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

Linux Distros Unpatched Vulnerability : CVE-2026-18302

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GIMP TIF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102069)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102069 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: reserve enough transaction items for qgroup ioctls Currently our qgroup ioctls don't...

Kibana 8.9.x < 8.19.19 / 9.x < 9.4.5 Missing Authorization (ESA-2026-86)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.19, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-86 advisory. - The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created th...

PT-2026-79291

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

Linux Distros Unpatched Vulnerability : CVE-2026-77647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-102703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102703 advisory. A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the chann...

Linux Distros Unpatched Vulnerability : CVE-2026-64846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can...

Linux Distros Unpatched Vulnerability : CVE-2025-25977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. CVE-2025-25977 Note that Nessus relies on...

AIX : Multiple Vulnerabilities (IJ59565)

The version of AIX installed on the remote host is prior to APAR IJ59565. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59565 advisory. - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102025)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102025 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix racy bitfield write in btrfsclearspaceinfofull From the memory-barriers.txt document...

PT-2026-79344

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before...

PT-2026-79353

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 documents. The STIX import code used sys.exit to handle several parsing and loading failures. Because SystemExit inherits from BaseException rather than Exception, these failures...

PT-2026-79410

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eva...

PT-2026-79486

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are...