libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

CVE-2026-21140

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

PRTG Network Monitor - Local File Inclusion

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges including administrator. A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local...

EUVD-2026-91157

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

CVE-2026-21140

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

CVE-2026-21140

A vulnerability exists in ManagedProvisioning prior to SMR Sep-2026 Release 1 due to improper access control . This flaw allows local attackers to install arbitrary applications on the affected system. Specific exploit details are not provided in the documents.

CVE-2026-21140

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

CVE-2026-92174: Improper Control of Filename for Include/Require Statement in PHP Program

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary...

CVE-2026-91784: Improper Neutralization of Argument Delimiters in a Command

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-94592: Use of Hard-coded Credentials

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can...

CVE-2026-104411: Improper Neutralization of Input During Web Page Generation

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...

PT-2026-104154

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-21140: Undefined Security Weakness

Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications...

PT-2026-104082

Name of the Vulnerable Software and Affected Versions SiteOrigin Widgets Bundle versions prior to 1.73.3 Description The SiteOrigin Widgets Bundle plugin for WordPress contains a Local File Inclusion flaw. Authenticated attackers with contributor-level access or higher can include and execute...

PT-2026-104406

Name of the Vulnerable Software and Affected Versions Nx versions prior to 22.7.9 Nx versions 23.0.0 through 23.1.1 Description Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build...

PT-2026-104222

Name of the Vulnerable Software and Affected Versions Ghost versions 6.22.1 through 6.63.x Description A stored cross-site scripting issue exists where staff users can host malicious scripts by uploading files that are served with extension-derived content types using the default local storage...

CVE-2026-47518

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in a secure microcontroller component, where incorrect permission assignment for a critical resource allows an attacker with privileged local access to modify protected memory that should be restricted. A successful exploit ...

CVE-2026-47603

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information disclosure...

Linux Distros Unpatched Vulnerability : CVE-2026-97876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while...

MiracleLinux 9 : gvfs-1.48.1-8.el9_8.1 (AXSA:2026-1955:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1955:04 advisory. gvfs: SFTP: heap-based buffer overflow in readreply CVE-2026-84268 gvfs: gvfs-admin socket ownership race permits local root CVE-2026-88924 Tenable...