CVE-2026-75465

The /api.php/user/getlist endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters t...

PT-2026-81310

A security vulnerability has been detected in macrozheng mall up to 1.0.3. Affected is the function OmsCartItemServiceImpl.updateQuantity of the file /cart/update/quantity. The manipulation of the argument quantity leads to business logic errors. The attack may be initiated remotely. The vendor...

PT-2026-81441

Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interacti...

PT-2026-81255

An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 and later unreleased branches on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitrar...

PT-2026-81264

A vulnerability was found in liketrek TREK up to 3.0.22. Impacted is the function loginUser of the file server/src/services/authService.ts of the component Pre-2FA mfa token Handler. The manipulation results in improper authentication. The attack may be performed from remote. Upgrading to version...

PT-2026-81399

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description A heap out-of-bounds write occurs on 32-bit/ILP32 builds when processing a crafted tiled EXR file via the TiledRgbaInputFi...

PT-2026-81496

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 3.2.11 OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13 Description The exrmultiview utility can perform a heap out-of-bounds write when combining two valid scanline EXR files if the union...

PT-2026-81886

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.25 through 9.0.120 Apache Tomcat versions 8.5.46 through 8.5.100 Apache Tomcat versions 7.0.97 through 7.0.109...

PT-2026-81154

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An arbitrary file read issue exists in the TagReference.create function. A positional reference parameter allows the bypass of the unsafe option guard, enabling attackers to provide a reference...

PT-2026-81391

Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud mcp server/vector/webhook receiver.py has no authentication by default because WEBHOOK SECRET defaults to None and startu...

RockyLinux 9 : python3.14 (RLSA-2026:58901)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58901 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-76172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization...

AlmaLinux 10 : python3.12 (ALSA-2026:58902)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58902 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

EulerOS Virtualization 2.13.0 : bzip2 (EulerOS-SA-2026-3207)

According to the versions of the bzip2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : bzip2 contains an offbyone error in the bzip2recover utility. When processing a specially crafted file, the application performs an...

Oracle Linux 9 : python-pyasn1 (ELSA-2026-59242)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59242 advisory. - Fix CVE-2026-59886: prevent overflow in Real type float conversion Tenable has extracted the preceding description block directly from the Oracle Linux...

AlmaLinux 10 : gstreamer1-plugins-base (ALSA-2026:59097)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59097 advisory. gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow CVE-2026-18297 Tenable has extracted the preceding description block directly...

Linux Distros Unpatched Vulnerability : CVE-2026-55059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12...

RHEL 8 : sg3_utils (RHSA-2026:59555)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59555 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

AlmaLinux 8 : python-pyasn1 (ALSA-2026:59241)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59241 advisory. pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-59886 Tenable has extracted the preceding description block directly from the AlmaLinux...

EulerOS Virtualization 2.13.1 : perl-HTTP-Tiny (EulerOS-SA-2026-3188)

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values.The...