EUVD-2026-90574

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-103543

A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclos...

CVE-2026-103543

A SQL injection vulnerability exists in the itsourcecode Leave Management System 1.0 . The flaw is located within an unknown function in the /module/leavetype/controller.php file, where improper handling of the LEAVTID argument allows for remote exploitation. The documents state that the exploit ...

EUVD-2026-90505

A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclos...

SUSE CVE-2026-98054

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

CLEANSTART-2026-TD83938 malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation

Security vulnerability affects the kube-state-metrics-fips package. A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation...

PT-2026-103747

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Rocky Linux 10.1 [CIQ] Security Update: qt6-qtsvg / qt6-qtsvg-debuginfo / qt6-qtsvg-debugsource / etc (crlsa-2025_22394)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202522394 advisory. qtsvg: Uncontrolled recursion in Qt SVG module CVE-2025-10728 Tenable has extracted the preceding description block directly from the CIQ security advisory. Not...

Rocky Linux 9 [CIQ] Security Update: evince / evince-debuginfo / evince-debugsource / evince-libs / etc (crlsa-2026_27819)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202627819 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2025:1751145522)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751145522 advisory. - A defect was discovered in the Python ssl module where there is a memory race condition with the ssl.SSLContext methods certstorestats and...

CentOS Linux 6 [TuxCare] Security Update: gdb / gdb-gdbserver (CENTOS6:CLSA-2026:1777446434)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777446434 advisory. - GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access. The impact is: Deny of Service, Memory Disclosure, and...

AlmaLinux 9.2 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1766598218)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1766598218 advisory. - A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. The problem is missing initialization of...

CentOS Linux 8 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1781179629)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1781179629 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block memb...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1781083045)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781083045 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as...

Rocky Linux 8 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_6962)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20246962 advisory. python: incorrect IPv4 and IPv6 private ranges CVE-2024-4032 cpython: python: email module doesn't properly quotes newlines in email headers, allowing head...

CentOS Linux 8.4 [TuxCare] Security Update: python2 / python2-debug / python2-devel / python2-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1772192033)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1772192033 advisory. - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote newlines for email headers when...

PT-2026-105917

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load custom generate. The function fetches and caches a remote module file before performing the required trust...

CVE-2026-103690: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-97661: Improper Neutralization of Input During Web Page Generation

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-64948: Authorization Bypass Through User-Controlled Key

Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards...