Dotnetnuke < 10.3.3 Optional JavaScript restrictions for HTML module content (GHSA-mjq6-87j6-5f4g)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - The HTML module historically allowed trusted content editors to include JavaScript within HTML content. A new security option ha...

Dotnetnuke < 10.3.3 Unauthorized likes on private journal posts (GHSA-r4c4-vmqp-vxf2)

According to its self-reported version, the instance of Dotnetnuke running on the remote web server is prior to 10.3.3. It is, therefore, affected by a vulnerability. - An authorization vulnerability in the Journal module could allow an authenticated user to add a like to a private journal post...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098944)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098944 advisory. In the Linux kernel, the following vulnerability has been resolved: module: Fix kernel panic when a symbol stshndx is out of bounds The module loader doesn't check...

PT-2026-82304

Name of the Vulnerable Software and Affected Versions JeecgBoot version 3.9.2 Description Remote command execution is possible in the CodeNode component of the AI Flow module, which supports Groovy script execution. The SecurityCheck class uses a blacklist to intercept dangerous calls; however,...

PT-2026-82130

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn module where key slots are released through a kref, and the release path frees AEAD Authenticated Encryption with Associated Data transforms from an RCU...

ROS-20260826-73-0006

The vulnerability of the ath9khifusballoctxurbs function in the drivers/net/wireless/ath/ath9k/hifusb.c module of the Atheros/Qualcomm wireless adapter driver in the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker t...

PT-2026-82135

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ovpn component where crypto completion callbacks do not properly manage references to the key-slot and peer. Specifically, the peer reference pins the netdev, and...

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...

PT-2026-82363

Name of the Vulnerable Software and Affected Versions Drupal Commerce CyberSource versions 0.0.0 through 1.10.0 Description An observable timing discrepancy in the Secure Acceptance Hosted Checkout gateway integration allows for brute force attacks. The module fails to correctly verify the...

PT-2026-82172

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the atmel-mci driver due to a race condition in the atmci remove function. The &host-bh work variable is bound to the atmci work func function and can be...

Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111

This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may remain accessible until caches are cleared...

PT-2026-82371

Name of the Vulnerable Software and Affected Versions CAPTCHA Protected Page versions 0.0.0 through 1.0.2 Description An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

TencentOS Server 3: nginx:1.24 (TSSA-2026:0886)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0886 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-80564

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gve: fix NULL dereference due to missing ptp adjfine Fix NULL dereference due to missing implementation of adjfine, which can be triggered from usermode as...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104751)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104751 advisory. Type confusion in PostgreSQL module refint allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this...

Linux Distros Unpatched Vulnerability : CVE-2026-80556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt,...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...