CVE-2026-100835

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to...

CVE-2026-100744

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100740

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

EUVD-2026-87817

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744

A flaw in coollabsio Coolify versions up to 4.1.2 within the Route-Level Middleware component leads to a missing authorization vulnerability. The issue resides in an unknown function within the app/Http/Middleware/CanUpdateResource.php file. This flaw can be triggered via a remote manipulation at...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100740 D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

CVE-2026-100740

The D-Link DIR-895L router, running firmware A1_102b07 , contains an out-of-bounds write (CWE-787 / CWE-119) vulnerability in the L2TP Control Channel Parser within the tunnel.c file. Specifically, the tunnel_set_params() function fails to properly handle the Host Name AVP ; while the length is c...

CVE-2026-100740 D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

EUVD-2026-87816

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

EUVD-2026-87814

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-100740: Out-of-bounds Write

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

CVE-2026-100877: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file registrationform.php. Executing a manipulation of the argument FName/LName/Addrs can lead to cross site...

CVE-2026-100746: Missing Authentication for Critical Function

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

Fedora 43 : pgadmin4 (2026-dddd2792e3)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dddd2792e3 advisory. Update to pgadmin-9.18. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2026-99726

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.5 Description An authorization bypass exists in the admin-config-setup component within the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php. This issue allows a remote attacker to bypa...

CVE-2026-100724: Inconsistent Interpretation of HTTP Requests

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...

Fedora 45 : pgadmin4 (2026-035cf95dc5)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-035cf95dc5 advisory. Update to pgadmin-9.18. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 43 : ckermit (2026-cc3b077d5b)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cc3b077d5b advisory. Update to 11.0.509 to address CVE-2025-68920 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Ness...