CVE-2026-111446

Wheels versions 4.0.0 through 4.1.2 contain a vulnerability where password-less development tools are exposed under */wheels/ to remote clients when enablePublicComponent=true (the default in development). Prior to version 4.1.2, these tools lacked local-access restrictions; version 4.1.2 introdu...

Astra Linux – Vulnerability in Less

Closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...

Astra Linux – Vulnerability in Systemd

Before version 247, systemd does not properly prevent local privilege escalation for certain Sudo configurations. For example, plausible sudoers files may allow the execution of the “systemctl status” command. Specifically, systemd does not set LESSSECURE to 1, allowing other programs to be...

CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component Improper Privilege Management

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

EUVD-2026-97904

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-18513: Improper Privilege Management

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition...

CVE-2026-97348

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.74.3 . The flaw exists in the get_instance_css function, where the [siteorigin_widget] shortcode handler directly calls $the_widget->widget() on attacker-supplied decod...

CVE-2026-97348 SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...

CVE-2026-97348 SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the getinstancecss function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary file...

CVE-2026-78015

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...

EUVD-2026-95565

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...

CVE-2026-78015

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16 , is affected by a Use of Less Trusted Source vulnerability (CWE-348). An unauthenticated attacker with remote access could potentially exploit this flaw to cause information tampering . No specific exploit details or ...

CVE-2026-78015

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...

CVE-2026-78015: Use of Less Trusted Source

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...

CVE-2026-98346

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

Rocky Linux 8.8 [CIQ] Security Update: less / less-debuginfo / less-debugsource (ciqsa-2026_0941)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260941 advisory. This advisory aggregates security fixes for the less SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2022-48624. Tenable has extracted the preceding description bloc...

AlmaLinux 9.2 [TuxCare] Security Update: less (ALMALINUX9.2:CLSA-2024:1716271951)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1716271951 advisory. - closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Note that Nessus has not tested for this...

CentOS Linux 7.9 [CIQ] Security Update: less / less-debuginfo (ciqsa-2026_0692)

The CentOS Linux 7.9 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260692 advisory. This advisory aggregates security fixes for the less SRPM in CIQ CentOS Bridge 7.9. It addresses 1 CVE: CVE-2022-48624. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: less / less-debuginfo / less-debugsource (ciqsa-2026_0942)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260942 advisory. This advisory aggregates security fixes for the less SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2022-48624. Tenable has extracted the preceding description bloc...

Rocky Linux 8.8 [CIQ] Security Update: less / less-debuginfo / less-debugsource (ciqsa-2026_0303)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260303 advisory. This advisory aggregates security fixes for the less SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2024-32487. Tenable has extracted the preceding description bloc...