PT-2026-67131

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

Atlassian Confluence 9.0.1 / 9.1.x / 9.2.x < 9.2.17 / 9.3.1 / 9.4.x / 9.5.1 / 10.0.2 / 10.1.x / 10.2.x < 10.2.7 (CONFSERVER-104334)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104334 advisory. - This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and...

CLEANSTART-2026-BB26789 Security fixes in spark-operator 2.3.0-r3

Package spark-operator version 2.3.0-r3 fixes 4 vulnerabilities: CVE-2026-32281, CVE-2026-32288, CVE-2026-32289, CVE-2026-32280...

EUVD-2026-50965

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial ...

CVE-2026-67245 A path traversal vulnerability was found in the VPN Clients on the ADM

A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs because user-controlled certificate name input is not sufficiently validated before being used to construct the upload destination path. An authenticated attacker can exploit this issue to write an...

CVE-2026-67244

A format string vulnerability in ADM’s Notification OAuth settings is triggered by user-controlled notification configuration input that is processed via an unsafe format-string operation. Exploitation requires authenticated administrator privileges and can disclose memory information or cause de...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

Fedora 44 : lego (2026-30e8e9a2b2)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-30e8e9a2b2 advisory. Update to 5.3.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

SUSE-SU-2026:22938-1 Security update for runc

This update for runc fixes the following issues: Update to 1.3.6. - CVE-2026-41579: malicious image with a /dev symlink can trigger limited host filesystem integrity violations bsc1268275. Other updates and bugfixes: - Version 1.3.6: Various integration test improvements. When masking directories...

CVE-2026-65521

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

EUVD-2026-48186

Subscriber Cross Site Scripting XSS in Masteriyo - LMS = 2.3.0 versions...

EUVD-2026-47423

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: RTP Proxy. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

EUVD-2026-47377

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Security. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PL...

CVE-2026-61226

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: RTP Proxy. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

CVE-2026-61173

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Security. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this...

CVE-2026-61171

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Security. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this...

CLEANSTART-2026-NW12954 Security fixes for CVE-2020-8908, CVE-2023-2976, CVE-2025-67735, CVE-2026-0636, CVE-2026-1225, CVE-2026-22741, CVE-2026-22745, CVE-2026-22746, CVE-2026-22751, CVE-2026-33870, CVE-2026-33871, CVE-2026-40973, CVE-2026-41284, CVE-2026-41293, CVE-2026-41417, CVE-2026-42498, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-50020, CVE-2026-5598, ghsa-38f8-5428-x5cv, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-57rv-r2g8-2cj3, ghsa-5mg8-w23w-74h3, ghsa-5x3r-wrvg-rp6q, ghsa-72hv-8253-57qq, ghsa-7g45-4rm6-3mm3, ghsa-84h7-rjj3-6jx4, ghsa-c2gf-v879-257j, ghsa-c653-97m9-rcg9, ghsa-f6hv-jmp6-3vwv, ghsa-hvcg-qmg6-jm4c, ghsa-m4cv-j2px-7723, ghsa-mj4r-2hfc-f8p6, ghsa-pwqr-wmgm-9rr8, ghsa-qqpg-mvqg-649v, ghsa-v8h7-rr48-vmmv, ghsa-w9fj-cfpg-grvv, ghsa-wwpq-f5c3-7hvx, ghsa-x4gw-5cx5-pgmh, ghsa-xxqh-mfjm-7mv9 applied in versions: 4.3.2-r2, 4.3.2-r3

Multiple security vulnerabilities affect the cloud-config-server package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63098

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Security. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle...

CVE-2026-54163 secure_headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input

secureheaders manages application of security headers with many safe defaults. Prior to 7.3.0, secureheaders builds the Content-Security-Policy value by stitching directives with ; separators, and buildsandboxlistdirective, buildmediatypelistdirective, and buildreporttodirective interpolate...

CVE-2026-9585

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...