PT-2026-90311

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.12.95 Description A race condition exists in the fsnotify system affecting fanotify and inotify. When a mark receives a new event bit, the system may skip recalculating the object mask if the cached aggregate already...

PT-2026-96360

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...

CVE-2026-89595: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix stale object mask after concurrent mark updates When a mark gets a new event bit, fanotify and inotify may avoid recalculating the object mask if the cached aggregate already contains that bit. This is racy with a...

Linux Distros Unpatched Vulnerability : CVE-2026-88046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject...

Fedora 44 : dokuwiki (2026-9bbb604ea2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9bbb604ea2 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...

PT-2026-90038

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

PT-2026-90126

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Netlink handlers for tunnel create, tunnel modify, session create, and session modify send multicast notifications via helpers. These helpers may fail during message allocation, encoding...

PT-2026-90163

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommufd access notify unmap function where internal accesses are skipped because they lack an external unmap callback. The process incorrectly calls iommufd lock o...

Linux Distros Unpatched Vulnerability : CVE-2026-49836

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path...

Fedora 43 : dokuwiki (2026-046b69d591)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-046b69d591 advisory. Backport object injection RCE fix - see https://github.com/dokuwiki/dokuwiki/issues/4752 Tenable has extracted the preceding description block directly from...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

rclone: source object names can escape the configured root on upload

Summary Multiple backends, when given a specially crafted object to copy, can escape the backend confinement. | Backend | Keep/Close | Per-backend severity | |---|---|---| | sftp | Medium | Real filesystem escape, fires under default encoding. | | smb | Low-Medium | Escapes to a different SMB sha...

Improper Validation of Specified Type of Input

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the meta object in calendar events, which is stored without validation. An attacker can disrupt calendar alert functionality for all users by submitting a...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836 psd-tools: arbitrary file write via smart-object filename

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an...

CVE-2026-49836

psd-tools (Python library for Adobe Photoshop PSD files) is vulnerable to arbitrary file write and arbitrary file read via unsanitized smart-object paths. In all releases through v1.17.0 , SmartObject.save() uses the embedded filename from the PSD verbatim—no basename, no .. filtering, no absolut...

WordPress BuddyPress plugin <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion vulnerability

Insecure Direct Object Reference to Notifications Deletion vulnerability discovered by Brian Mungai in WordPress Plugin BuddyPress versions = 14.3.3...

CVE-2026-80434

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an insecure direct object reference (IDOR) flaw that allows a remote authenticated attacker to manipulate runtime caches and cause a denial of service . The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) , with a scope change indica...

CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...