PT-2026-97189

Name of the Vulnerable Software and Affected Versions JSM Show Post Metadata WordPress plugin versions prior to 4.9.1 Description Insufficient escaping of a post meta key before it is output into an inline event-handler attribute within an admin-facing meta box allows users with contributor-level...

PT-2026-97528

Name of the Vulnerable Software and Affected Versions Red Hat Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the automation-controller where the log message formatting for API 4XX errors uses an administrator-controlled Python...

CVE-2026-86708: Use of Hard-coded Cryptographic Key

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated...

PT-2026-105761

This update for openSUSE-signkey-cert fixes the following issues: Adds the UEFI signing key of Leap 16.0. This needs to be imported via the MOK dialog on boot...

BitBake SSH MITM

The vulnerability of the automation tool for configuring and building projects based on BitBake is related to incorrect verification of the SSH key. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middle” attack...

Enterprise Access Management EAM does not rotate RSA keys

Overview Imprivata Enterprise Access Management EAM, an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26.2.6 and below. The product provides no supported mechanism to rotate its RSA key pair after deployment, meaning the...

Linux Distros Unpatched Vulnerability : CVE-2026-89422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the intended...

RockyLinux 8 : coreutils (RLSA-2026:69964)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69964 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly from t...

CVE-2026-18154

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

CVE-2026-18154

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to the use of a hard-coded or predictable cryptographic key (CWE-321 ). This flaw could allow a remote attacker to obtain sensitive information. The vulnerability affects FTM versions 4.0.6.0 through 4.0.10.0 (specifically...

CVE-2026-18154 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

CVE-2026-18154 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key...

kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report()

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol HIDP. A remote attacker, by sending specially crafted truncated packets from a paired Bluetooth device, could trigger an out-of-bounds read in the hidpinputreport function. This vulnerability may lead to unintended...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...

wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

CVE-2026-94455

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The...

SUSE CVE-2026-93160

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-ecc - reject hardware ECDH without a public key The hardware ECDH path in atmelecdhcomputesharedsecret uses the private key stored in the device. However, the public key is cached only after atmelecdhsetsecret...

CVE-2026-56681

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip...

CVE-2026-94455

The postiz-app software is vulnerable to a critical authentication bypass due to the enterprise controller being omitted from the authentication middleware's explicit controller list. An unauthenticated attacker can access the provisioning endpoint for enterprise and reseller organisations by pro...