PT-2026-6181

Name of the Vulnerable Software and Affected Versions GLPI versions 0.71 through 10.0.22 GLPI versions 0.71 through 11.0.4 Description GLPI is an asset and IT management software package. When remote authentication is used with Single Sign-On SSO variables, a user can potentially gain access to...

SUSE SLES16 Security Update : unbound (SUSE-SU-2026:20201-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:20201-1 advisory. Update to 1.24.1: - CVE-2025-11411: Fixed possible domain hijacking attack bsc1252525. Tenable has extracted the preceding description bloc...

Symantec Endpoint Protection Client < 14.3 RU8 Patch 3 / 14.3 RU9 Patch 2 / 14.3 RU10 Patch 1 Multiple Vulnerabilities (36774)

The version of Symantec Endpoint Protection SEP Client installed on the remote host is affected by a multiple vulnerabilities as referenced in the 36774 advisory. - Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privile...

openSUSE 16 Security Update : unbound (openSUSE-SU-2026:20139-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20139-1 advisory. Update to 1.24.1: - CVE-2025-11411: Fixed possible domain hijacking attack bsc1252525. Tenable has extracted the preceding description block directly fr...

PT-2026-6263

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.9 n8n versions prior to 2.2.1 Description n8n is a workflow automation platform. A Cross-Site Scripting XSS issue existed in a markdown rendering component within the n8n interface, affecting areas that support...

CVE-2026-25054: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

n8n is an open source workflow automation platform. Prior to versions 1.123.9 and 2.2.1, a Cross-Site Scripting XSS vulnerability existed in a markdown rendering component used in n8n's interface, including workflow sticky notes and other areas that support markdown content. An authenticated user...

CVE-2026-25051: Improper Neutralization of Input During Web Page Generation

n8n is an open source workflow automation platform. Prior to version 1.123.2, a Cross-Site Scripting XSS vulnerability has been identified in the handling of webhook responses and related HTTP endpoints. Under certain conditions, the Content Security Policy CSP sandbox protection intended to...

n8n security vulnerabilities

n8n is an open-source, scalable workflow automation tool developed by n8n. Versions of n8n prior to 1.123.9 and 2.2.1 contained security vulnerabilities. These vulnerabilities were due to improper handling of the Markdown rendering component, which could lead to cross-site scripting attacks,...

GLPI authorization issue vulnerabilities

GLPI is an open-source IT and asset management software developed by GLPI. This software provides a comprehensive IT resource management interface, allowing you to create databases to manage various IT assets such as computers, monitors, servers, printers, network devices, telephones, and even...

PT-2026-5868

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.1.0 Description IBM Concert is susceptible to HTTP header injection due to inadequate validation of the HOST headers. This issue could enable an attacker to perform various attacks against the system,...

CVE-2026-24051

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking Untrusted Search Paths on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search pat...

CVE-2024-5386

In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerability is triggered when the 'viewer' role...

CVE-2025-11261

A flaw was found in MediaWiki. This vulnerability, known as Cross-site Scripting XSS, occurs due to improper neutralization of input during web page generation. A remote attacker could exploit this by injecting malicious scripts into web pages. Successful exploitation could lead to arbitrary code...

CVE-2025-61640

A flaw was found in MediaWiki. A remote attacker can exploit this Cross-site Scripting XSS vulnerability by injecting malicious scripts into web pages due to improper neutralization of input during web page generation. This could lead to arbitrary code execution in the context of the user's...

Moodle security vulnerabilities

Moodle is an open-source e-learning software platform developed by Moodle Foundation. It is also known as a course management system, learning management system, or virtual learning environment. Moodle has security vulnerabilities, which stem from improper handling of AI responses. These...

Security update for unbound (moderate)

openSUSE security update: security update for unbound ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20139-1 Rating: moderate References: bsc1252525 Cross-References: CVE-2025-11411 CVSS scores: CVE-2025-11411 SUSE : 6.9...

PT-2026-5946

Name of the Vulnerable Software and Affected Versions Lexmark Embedded Solutions Framework affected versions not specified Description An untrusted search path issue exists in Lexmark devices, potentially allowing an attacker to execute arbitrary code. This flaw enables DLL hijacking without...

AZL-76449 CVE-2026-24051 affecting package cri-o 1.30.1-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking Untrusted Search Paths on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search pat...

AZL-81200 CVE-2026-24051 affecting package kata-containers-preview 3.27.0~preview2-2

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking Untrusted Search Paths on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search pat...

AZL-76443 CVE-2026-24051 affecting package azl-otel-collector 0.127.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking Untrusted Search Paths on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search pat...