CVE-2026-89071: Improper Neutralization of Special Elements used in an LDAP Query

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89076: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

Rocky Linux 10.2 [CIQ] Security Update: environment-modules / environment-modules-debuginfo / etc (crlsa-2026_80664)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680664 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable...

PT-2026-114329

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An incorrect implementation of the authentication algorithm exists within the SFTP module. Approximately 1,700 instances have been...

PT-2026-114320

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An authentication bypass exists in the LDAP module due to a missing critical step in the authentication process. Approximately 1,700...

PT-2026-114321

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description Progress MOVEit Transfer Ad Hoc module contains a stored cross-site scripting issue, which occurs when input is not properly neutralized...

CVE-2026-89069: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer Ad Hoc module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

Drupal 10.6.x < 10.6.19 / 11.3.x < 11.3.19 / 11.4.x < 11.4.10 Multiple Vulnerabilities (drupal-2026-10-14)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.19, 11.3.x prior to 11.3.19, or 11.4.x prior to 11.4.10. It is, therefore, affected by multiple vulnerabilities. - The Drupal core Link module provides a field type that can be...

PT-2026-114322

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An authentication bypass exists in the OIDC module due to a capture-replay flaw. Approximately 1,700 instances have been identified...

PT-2026-114323

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An LDAP injection issue exists in the LDAP module, where special elements used in an LDAP query are not properly neutralized. This allows...

PT-2026-114324

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An incorrect authorization issue exists within the Client Certificates module of Progress MOVEit Transfer. Recommendations Update to...

CVE-2026-89072: Incorrect Authorization

Incorrect Authorization vulnerability in Progress MOVEit Transfer Client Certificates module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89070: Authentication Bypass by Capture-replay

Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer OIDC module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

Active Directory Certificate Services CA Chase Configuration Checker

The Certighost NetExec SMB module checks Active Directory Certificate Services configuration for the EDITFATTRIBUTESUBJECTALTNAME2 chase flag associated with CVE-2026-54121...

Linux Distros Unpatched Vulnerability : CVE-2026-101019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization...

CVE-2026-89068: Missing Critical Step in Authentication

Missing critical step in authentication vulnerability in Progress MOVEit Transfer LDAP module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-92817

A flaw was found in Ignition. The Perspective module fails to properly validate session privileges when determining Designer-level access. An authenticated attacker with access to a Vision project can supply a valid session identifier to obtain elevated Designer privileges. This can be exploited ...

CVE-2026-92817

The Ignition Perspective module in Inductive Automation Ignition software contains an incorrect authorization vulnerability (CWE-863). The software fails to properly validate session privileges when determining Designer-level access . Specifically, an authenticated user with access to a Vision pr...

CVE-2026-92817 Inductive Automation Ignition Software Incorrect Authorization

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these...

CVE-2026-63157

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address adress field that is echoed into an onclick event-handler attribute without neutralizing quotes...