Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers across US Critical Infrastructure

The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology OT devices, including programmable logic controllers PLCs. These actions disrupted PLCs across several U.S. critical infrastructure sectors through...

Fedora 44 : perl-DBI (2026-1c5ffc6018)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1c5ffc6018 advisory. 1.651 bump - Fix CVE-2026-15043, CVE-2026-15392, CVE-2026-60082 and CVE-2026-60081 Tenable has extracted the preceding description block directly fr...

CVE-2026-60081 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-60081 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-15043 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-15043 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

GO-2026-6034 Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev

Gitea: Privilege Escalation via Access Token Scope Escalation in API in gitea.dev...

GO-2026-6040 Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev

Gitea: Webhook Authorization Header Returned in Plaintext via API in gitea.dev...

GHSA-HRXH-6V49-42GF vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, kubernetes-csi-external-health-monitor, sops, crossplane-provider-aws-cloudformation, amazon-cloudwatch-agent-operator, steampipe, cert-manager-istio-csr, op-geth, crossplane-provider-aws-cloudfront, k3s, ksops, argo-workflows, trivy,...

SUSE CVE-2026-16441

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

EUVD-2026-47744

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

EUVD-2026-47735

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-46737

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-46737

Dell PowerProtect Data Manager (versions prior to 20.2.0.0) contains an Improper Input Validation vulnerability in its REST API. A high-privilege attacker with remote access could exploit this flaw to achieve remote code execution. In practice, this affects the REST API surface and is mitigated b...

CVE-2026-46738

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-46738

Dell PowerProtect Data Manager is affected (versions prior to 20.2.0.0). The issue is an Improper Input Validation in the REST API that can be triggered over the network. A highly privileged attacker with remote access could exploit this to achieve an Elevation of Privileges . The available docum...

CVE-2026-14865

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...

CVE-2026-13187

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

EUVD-2026-47697

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...

CVE-2026-13188

The vulnerability CVE-2026-13188 affects Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708. In DialogHandler, request parameters may be tampered with, potentially altering server-side dialog behavior and enabling chained exploitation. Impact as stated: no confidentiality leakage, but inte...

CVE-2026-13187 DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...