CVE-2026-50782

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

CVE-2025-65340

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php...

CVE-2025-65337

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

CVE-2025-69942

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...

CVE-2025-69944

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter...

SUSE SLED15 / SLES15 Security Update : libssh (SUSE-SU-2026:3330-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3330-1 advisory. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: deni...

Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload

The version of the iCagenda extension for the Joomla! application running on the remote host is 3.2.1 prior to 3.9.15 or 4.x prior to 4.0.8. It is, therefore, affected by an arbitrary files upload vulnerability in the file attachment feature, ultimately resulting in PHP code upload and execution...

Linux Distros Unpatched Vulnerability : CVE-2026-64646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js...

Linux Distros Unpatched Vulnerability : CVE-2026-54620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while stil...

Check Point Gaia Operating System (sk185153)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk185153 advisory. - A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with roo...

SUSE SLES16 Security Update : alloy (SUSE-SU-2026:22946-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:22946-1 advisory. This update for alloy fixes the following issue: Update to version 1.17.1. Security issue fixed: - CVE-2026-10722: github.com/cilium/ebpf:...

Linux Distros Unpatched Vulnerability : CVE-2026-62435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant...

Linux Distros Unpatched Vulnerability : CVE-2026-58224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CTDB fails to do a number of integrity checks on received packets. This includes: checking of field lengths against packet lengths when unmarshalling packets;...

Linux Distros Unpatched Vulnerability : CVE-2026-50737

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber...

Oracle Linux 8 : compat-libtiff3 (ELSA-2026-47183)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-47183 advisory. 3.9.4-16 - fix CVE-2026-12912: heap-buffer-overflow in PixarLog ABGR decoding RHEL-189375 Tenable has extracted the preceding description block directly from t...

Fedora 44 : kronosnet (2026-db53330c8f)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-db53330c8f advisory. CVE-2026-15811 LOW: encryption key exposure in memory after cryptographic configuration changes. Wipe cryptographic keys with explicitbzero before...

Microsoft Edge (Chromium) < 150.0.4078.81 (CVE-2026-15767)

The version of Microsoft Edge installed on the remote Windows host is prior to 150.0.4078.81. It is, therefore, affected by a vulnerability as referenced in the July 28, 2026 advisory. - Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker t...

MiracleLinux 9 : libpng-1.6.37-15.el9_8.2 (AXSA:2026-1378:13)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1378:13 advisory. libpng: libpng: Arbitrary code execution due to use-after-free vulnerability CVE-2026-33416 libpng: libpng: Information disclosure and denial of...

Rockwell Automation CompactLogix 5370 Improper Validation of Integrity Check Value (CVE-2025-11694)

A security issue exists within the affected CompactLogix 5370 controllers due to missing validation of sequence numbers and source IP addresses in the CIP protocol. An attacker can abuse the exposed Connection IDs visible on the controller's web interface to send forged CIP packets, resulting in ...

Linux Distros Unpatched Vulnerability : CVE-2026-18047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. B...