The vulnerability of the /admin/adminHome.php file on the web platform used for displaying and selling art works in the Online Art Gallery Shop Project allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the /admin/adminHome.php file on the web platform used for displaying and selling art works in the Online Art Gallery Shop Project is related to incorrect elimination of special elements in the output data. Exploitation of this vulnerability could allow an attacker, operating...

RockyLinux 9 : libssh (RLSA-2026:62217)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62217 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read lengt...

Linux Distros Unpatched Vulnerability : CVE-2026-52131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp b5693 and before has a Reachable Assertion via the ggufreader::read function. CVE-2026-52131 Note that Nessus relies on the presence of the package as...

RockyLinux 8 : libssh (RLSA-2026:62218)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62218 advisory. libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read lengt...

PT-2026-84587

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or...

CVE-2026-84359: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-81199: Exposure of Sensitive Information to an Unauthorized Actor

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user...

Missing permission checks in deployit-plugin allow enumerating credentials IDs

deployit-plugin 26.1.0 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another...

CVE-2026-77123: Insertion of Sensitive Information Into Sent Data

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...

CVE-2026-18672: Improper Limitation of a Pathname to a Restricted Directory

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...

CVE-2026-78598: Incorrect Authorization

Incorrect Authorization CWE-863 in the Kibana machine learning feature can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding machine learning job management privileges within a single Kibana space could cau...

CVE-2026-78602: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...

CVE-2026-81197: Exposure of Sensitive Information to an Unauthorized Actor

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished draft, pending and private...

CVE-2026-74927: Missing Authorization

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-78151: Exposure of Sensitive Information to an Unauthorized Actor

The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addresses, confirmation redirect targets and...

CVE-2026-77783: Authorization Bypass Through User-Controlled Key

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...

CVE-2026-84802: Missing Authorization

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrie...

CVE-2026-77782: Exposure of Sensitive Information to an Unauthorized Actor

The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...

The vulnerability of the GPU components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the XR components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the XR web browsers Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...