PT-2026-81295

A vulnerability was identified in liketrek TREK up to 3.0.22. The impacted element is the function findOrCreateUser of the file server/src/services/oidcService.ts of the component OIDC Service. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The...

Oracle Linux 10 : gstreamer1-plugins-good (ELSA-2026-59133)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59133 advisory. - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246557 Tenable has extracted the preceding description block directly from the Oracle Lin...

EulerOS Virtualization 2.13.0 : gnutls (EulerOS-SA-2026-3213)

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

EulerOS Virtualization 2.13.1 : libxslt (EulerOS-SA-2026-3184)

According to the versions of the libxslt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the exsltFuncResultComp function of libxslt, which handles EXSLT func:result elements during stylesheet parsin...

PT-2026-81312

A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .claude/settings.json of the component Default Local Worker Backend. The manipulation leads to os command injection. The attack can be initiated remotely. The...

PT-2026-81900

A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647 B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp server results in command injection. The attack can be initiated remotely. The exploit is now...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.12)

The version of AOS installed on the remote host is prior to 7.5.1.12. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.12 advisory. - A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file...

FreeBSD -- Unauthorized credential switching

Problem Description: In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This...

EulerOS Virtualization 2.13.1 : gnutls (EulerOS-SA-2026-3173)

According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

PT-2026-81239

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...

PT-2026-81203

Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with require interaction? set to true, AshAuthentication serve...

EulerOS Virtualization 2.13.1 : libssh2 (EulerOS-SA-2026-3181)

According to the versions of the libssh2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the...

Linux Distros Unpatched Vulnerability : CVE-2026-78147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserializetensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of...

EulerOS Virtualization 2.13.0 : libssh2 (EulerOS-SA-2026-3221)

According to the versions of the libssh2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauthpassword of the...

PT-2026-81428

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the pa...

PT-2026-81851

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in soup...

...[ More ]

This Metasploit module exploits CVE-2026-16232, an authentication bypass in the Check Point SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server. A vulnerable management server accepts a client-supplied SIC distinguished name during an...

PT-2026-81418

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vulnerable to a heap out-of-bounds write when exrmetrics reads a crafted deep scanline EXR. This occur...

PT-2026-81349

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verify math expression in src/qwed mcp/engines/math engine.py passes attacker-controlled expression and claimed result strings directly to SymPy's parse expr after only normalizing caret syntax to Python exponent syntax,...

PT-2026-81893

A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647 B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-based buffer overflow. It is possible ...