PT-2026-3963

Name of the Vulnerable Software and Affected Versions Themeum Tutor LMS versions through 3.9.4 Description An authorization bypass exists due to incorrectly configured access control security levels in Themeum Tutor LMS. This allows exploitation through a user-controlled key. Recommendations Upda...

MiracleLinux 8 : glib2-2.56.4-8.el8 (AXSA:2020-523:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-523:01 advisory. ibus: missing authorization allows local attacker to access the input bus of another user CVE-2019-14822 CVE-2019-14822 A flaw was discovered in ibus that...

MiracleLinux 8 : ibus-1.5.19-11.el8 (AXSA:2020-640:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-640:02 advisory. ibus: missing authorization allows local attacker to access the input bus of another user CVE-2019-14822 CVE-2019-14822 A flaw was discovered in ibus that...

VulnCheck KEV: CVE-2025-52665

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. ...

PT-2026-3221

Name of the Vulnerable Software and Affected Versions lucy-xss-filter versions prior to commit e5826c0 Description The software contains a flaw where an attacker can execute malicious JavaScript. This is due to improper sanitization resulting from misconfigured default superset rule files...

MiracleLinux 7 : pki-core-10.5.1-13.1.el7 (AXSA:2018-3231:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3231:02 advisory. pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access CVE-2018-1080 Tenable has extracted the preceding...

CVE-2021-47799

Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a shell, enabling unauthorized system-level privileges...

CVE-2021-47799

Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a shell, enabling unauthorized system-level privileges...

EUVD-2026-2754

Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a shell, enabling unauthorized system-level privileges...

CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

Wiz Research discovered a critical supply chain vulnerability that abused a CodeBuild misconfiguration to take over key AWS GitHub repositories - including the JavaScript SDK powering the AWS Console...

PT-2026-3776

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions prior to 9.13.0.0 Description The Dell PowerScale OneFS operating system has a security flaw due to inadequate security configurations. A remote attacker may be able to modify protected information by exploiting...

PT-2026-3103

Name of the Vulnerable Software and Affected Versions Juniper Networks Paragon Automation Pathfinder, Planner, Insights versions prior to 24.1.1 Description A clickjacking issue exists in the web portal of Juniper Networks Paragon Automation Pathfinder, Planner, Insights. This is due to the...

CVE-2026-20804

Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally...

CVE-2025-55462

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticat...

CVE-2025-55462

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticat...

PT-2026-2435

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 6519 Description ManageEngine ADSelfService Plus versions before 6519 are susceptible to an authentication bypass due to improper filter configurations. This allows unauthorized access. The iss...

CVE-2025-55462

Eramba Community/Enterprise Editions v3.26.0 are affected by a CORS misconfiguration that reflects an attacker-controlled Origin header in Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true. This enables authenticated cross-origin requests from malicious sites to endpoints su...

HPE Instant On Access Points 安全漏洞

HPE Instant On Access Points is a wireless access point from HPE America. A security vulnerability exists in HPE Instant On Access Points that stems from a router mode misconfiguration, which could disclose internal network configuration information...

CVE-2026-0674

Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Campaign Monitor for WordPress: from n/a through 2.9.1...

CVE-2026-22517

Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through = 2.10.0...