PT-2026-4104

Name of the Vulnerable Software and Affected Versions AivahThemes Anona versions through 8.0 Description A Path Traversal issue exists in AivahThemes Anona. The issue allows an attacker to traverse directory restrictions through improper pathname limitations. Recommendations Update AivahThemes...

PT-2026-4103

Name of the Vulnerable Software and Affected Versions AivahThemes Anona versions through 8.0 Description A flaw exists in AivahThemes Anona that allows for path traversal. This issue is due to improper limitation of a pathname to a restricted directory. The vulnerability could potentially allow...

PT-2026-4109

Name of the Vulnerable Software and Affected Versions AivahThemes Hostme v2 versions through 7.0 Description A Path Traversal issue exists in AivahThemes Hostme v2. The issue allows an attacker to traverse directory restrictions via improper pathname limitation. The API endpoint is not mentioned...

PT-2026-4041

Name of the Vulnerable Software and Affected Versions Marco van Wieren WPO365 versions n/a through 40.0 Description A Server-Side Request Forgery SSRF vulnerability exists in the wpo365-login component of Marco van Wieren WPO365. This flaw allows for Server Side Request Forgery. Recommendations...

CVE-2026-21949

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2026-21974

Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications component: Platform. The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Life...

CVE-2026-21952

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of...

CVE-2026-21950

Removed by vendor...

WordPress AdForest theme <= 6.0.11 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme AdForest versions = 6.0.11...

WordPress e-xact-hosted-payment plugin <= 2.0 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin E-xact Hosted Payment versions = 2.0...

CVE-2026-1132

A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/editfolder.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument folderid results in sql injection. The attack can be initiated remotely. The exploit has...

MiracleLinux 8 : dotnet7.0-7.0.109-1.el8.ML.1 (AXSA:2023-6236:23)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6236:23 advisory. dotnet: race condition in Core SignInManager PasswordSignInAsync method CVE-2023-33170 Tenable has extracted the preceding description block directly from th...

MiracleLinux 8 : mysql:8.0 (AXSA:2024-7561:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7561:01 advisory. mysql: InnoDB unspecified vulnerability CPU Apr 2023 CVE-2023-21911 mysql: Server: DDL unspecified vulnerability CPU Apr 2023 CVE-2023-21919,...

MiracleLinux 8 : php:8.0 (AXSA:2023-6531:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6531:01 advisory. php: XML loading external entity without being enabled CVE-2023-3823 php: phar Buffer mismanagement CVE-2023-3824 php: 1-byte array overrun in commo...

Oracle Health Sciences Applications security vulnerabilities

Oracle Health Sciences Applications is a clinical research and development solution developed by Oracle Corporation for the healthcare industry in the United States. The version 7.0.1.0 of Oracle Life Sciences Central Coding in Oracle Health Sciences Applications contains a security vulnerability...

MiracleLinux 7 : rh-mysql80-mysql-8.0.17-1.el7 (AXSA:2020-4497:03)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-4497:03 advisory. mysql: Server: Replication multiple unspecified vulnerabilities CVE-2019-2800, CVE-2019-2436, CVE-2019-2531, CVE-2019-2534, CVE-2019-2614,...

Fedora: Security Advisory (FEDORA-2026-f9c97702ca)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2026-1177

CVE-2026-1177 affects Yonyou KSOA 9.0. The issue is an SQL injection in an unknown functionality of /kmf/save_folder.jsp within the HTTP GET Parameter Handler, triggered by manipulating the folderid argument. It is remotely exploitable and the exploit has been publicly released. The vendor was re...

CVE-2026-1132

CVE-2026-1132 affects Yonyou KSOA 9.0. The vulnerability lies in the HTTP GET Parameter Handler, specifically the /kmf/edit_folder.jsp file, where manipulating the folderid argument enables SQL injection. The exploit appears to be public and exploitable remotely; there is no vendor response or co...

Yonyou KSOA SQL injection vulnerability

Yonyou KSOA is an enterprise-level management software developed by Yonyou Corporation in China. Version 9.0 of Yonyou KSOA contains a SQL injection vulnerability, which stems from incorrect handling of parameters named “ID” in the file/worksheet/worksaddplan.jsp. This vulnerability may lead to S...