CVE-2026-87650

Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 al...

PT-2026-89266

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backup file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

PT-2026-89402

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private...

Security Updates for Microsoft Office Online Server (September 2026)

The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-81947...

CVE-2026-87640

Out of bounds read in WebView in Google Chrome on on Android prior to...

CVE-2026-87586

Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 al...

CVE-2026-87596

Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 al...

CVE-2026-87592

Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 all...

Linux Distros Unpatched Vulnerability : CVE-2026-61908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of- bounds index. An authenticated user could attempt to...

Linux Distros Unpatched Vulnerability : CVE-2026-89046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate negative srcPosition...

CVE-2026-87602

Out of bounds read in ANGLE in Google Chrome on on Windows prior to 15...

PT-2026-89262

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-87525

Out of bounds read in Chromoting in Google Chrome on on Windows prior...

AlmaLinux 9 : qt5-qtbase (ALSA-2026:65993)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65993 advisory. qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 Tenable has extracted the preceding description block directly from the...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xlsdumpSummary function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets...

PT-2026-89517

Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVector::read in src/ccutil/genericvector.h reads the independent int32 fields reserved and size used from a .traineddata model without a cap or an invariant check. reservereserved allocates the backi...

PT-2026-89732

It was discovered that libEBML incorrectly handled certain read and write operations. An attacker could possibly use this issue to cause a buffer overflow, resulting in a denial of service...

Oracle Linux 9 : ELSA-2026-64808-0: / kernel (ELSA-2026-648080)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648080 advisory. - KVM: arm64: Bound usedlrs when flushing the pKVM hyp vCPU Jon Maloy RHEL-234207 CVE-2026-64287 - nvmet-auth: validate reply message payload bounds...

Security Updates for Microsoft Outlook Products C2R (September 2026)

The Microsoft Outlook Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. CVE-2026-69629 - Use of uninitialized resource in Microsoft...

RockyLinux 8 : qt5-qtbase (RLSA-2026:65897)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65897 advisory. qt: Qt: Denial of Service via out-of-bounds read in text codec handling CVE-2026-9499 Tenable has extracted the preceding description block directly from the...