SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3790-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3790-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security...

PT-2026-82785

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get arrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND IN SET SQL clause without proper sanitization. This allo...

Linux Distros Unpatched Vulnerability : CVE-2026-80183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by...

CVE-2026-37069

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

EUVD-2026-67264

Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests POST and GET to the...

PT-2026-82673

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

PT-2026-82538

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to file get contents without...

PT-2026-82770

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

...[ More ]

kamalpanse18 EmpManageX, a Flask-based employee management application, ships hard-coded administrative credentials in its authentication logic. The username admin and the plaintext password admin123 are module-level constants in app.py, compared directly against the values submitted to the...

Realtek Edimax 52fc10d19 Heap Buffer Overflow

The Realtek in-band ioctl bridge contains a heap buffer overflow when processing peer-supplied ioctl response data. The Realtek in-band ioctl bridge contains a heap-buffer overflow when processing peer-supplied ioctl response data. inbandioctl receives a response through the Realtek in-band...

...[ More ]

WatsonWebserver contains an HTTP/1 request body size-limit bypass when processing requests using Transfer-Encoding: chunked. The framework's configured Settings.IO.MaxRequestBodySize limit is enforced when a request declares its body size using Content-Length. However, requests using chunked...

EUVD-2026-67102

An integer overflow in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows attackers to cause a Denial of Service DoS via supplying a crafted HTTP/2 GET request...

EUVD-2026-67260

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-74730

In the Linux kernel, the following vulnerability has been resolved: NFS: Pin the 'struct nfsserver' during a FREESTATEID call Dan Aloni reports that he was able to hit a use-after-free bug if a FREESTATEID operation gets delayed for whatever reason. Fix this by bumping the refcount of the 'struct...

CVE-2026-74715

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...

PT-2026-82499

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter id ambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

PT-2026-82722

RedisChatMemoryRepository.findByMetadata builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape, unlike get, clear, and findByTimeRange in the same class which do escape their inputs. An application that passes user-controlled values to...

PT-2026-82672

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

CVE-2026-30045

An integer overflow vulnerability in the /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 allows a remote attacker to cause a Denial of Service (DoS) by supplying a crafted HTTP/2 GET request. The overflow occurs during processing of the NF instance discovery endpoint in the 5G core network...

PT-2026-82649

So I'm a little confused with CVE-2026-65643. Why was cPanel 11.110 patched against this when it went end of life in July 2024. But cPanel 11.126, which reached end of life in July 2026, did not get this update. Is cPanel 11.126 not affected by this? I get the cPanel 11.126 isn't receiving update...