45973 matches found
CVE-2026-95658: Cross-Site Request Forgery (CSRF)
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because moduleStatelessExecution executes a...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000561)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000561 advisory. Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Tenable has extracted the preceding description block directly from the Unity Linux security advisory...
kyverno-1.19.1-1.1 on GA media (moderate)
kyverno-1.19.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:11822-1 Rating: moderate Cross-References: CVE-2026-39821 CVE-2026-56853 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000537)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000537 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.0046. Tenable has extracted the preceding description block directly from the Unity Linux security advisory...
apptainer-1.5.3-4.1 on GA media (moderate)
apptainer-1.5.3-4.1 on GA media Announcement ID: openSUSE-SU-2026:11830-1 Rating: moderate Cross-References: CVE-2026-56854 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 CVSS scores: CVE-2026-56854 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2026-56854 SUSE : 8.6...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in uuid
Summary Security Bulletin:Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in uuid, IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of...
CVE-2026-59303
A flaw was found in Spring Cloud Stream where the dynamic destination cache size is not properly bound. This could lead to excessive memory consumption, potentially impacting system resources. An attacker with high privileges and user interaction could exploit this vulnerability over a network to...
CVE-2026-59306
A flaw was found in Spring Cloud Stream. This vulnerability involves the potential for deserialization of untrusted data. An attacker with high privileges and user interaction could exploit this to potentially impact the confidentiality and integrity of data. Mitigation To mitigate this issue,...
PT-2026-96083
Name of the Vulnerable Software and Affected Versions Neethi versions prior to 3.2.4 Description A specially crafted pair of WS-Policy documents can cause the policy-intersection process to perform exponential amounts of work, leading to high CPU utilization and a denial of service. Recommendatio...
shadowsocks-rust-1.25.0-1.1 on GA media (moderate)
shadowsocks-rust-1.25.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11818-1 Rating: moderate Cross-References: CVE-2025-3416 CVE-2026-25541 CVSS scores: CVE-2025-3416 SUSE : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2025-3416 SUSE : 6.3...
Oracle Linux 9 : curl (ELSA-2026-69126)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69126 advisory. - add sasl service name to connection reuse checks CVE-2026-8458 Tenable has extracted the preceding description block directly from the Oracle Linux...
CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...
EUVD-2026-83661
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...
PT-2026-95914
Name of the Vulnerable Software and Affected Versions Import and export users and customers WordPress plugin versions prior to 2.4.5 Description High-privileged users can perform Server-Side Request Forgery SSRF attacks during a CSV import. This occurs because the plugin fails to validate a...
CVE-2026-93990
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...
PT-2026-95874
Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.5 Description The software fails to validate low surrogates following high surrogates in UTF-16 input, which allows malformed UTF-16 sequences to be accepted. This behavior enables attackers to craft UTF-16 encoded...
CVE-2025-15698: Improper Neutralization of Input During Web Page Generation
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
libexpat -- Improper Handling of Unicode Encoding
https://github.com/libexpat/libexpat/pull/1282 reports: Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consu...
PT-2026-95750
Name of the Vulnerable Software and Affected Versions Business Name Generator WordPress plugin versions prior to 1.4 Description Insufficient sanitization and escaping of certain settings allow high-privilege users, such as administrators, to execute Stored Cross-Site Scripting XSS attacks. This...
