go-yaml Unmarshal DoS

The vulnerability of the Unmarshal function in the go-yaml library for the Go programming language is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-090031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090031 advisory. Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS : libssh2 vulnerabilities (USN-8799-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8799-1 advisory. It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebp (UTSA-2023-002880)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002880 advisory. Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a...

Unity Linux 20.1070e Security Update: libxslt (UTSA-2022-001980)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001980 advisory. Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Tenabl...

CVE-2026-76708: Use of Hard-coded Credentials

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

CVE-2026-76710: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-94491: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...

CVE-2026-18134: Cleartext Transmission of Sensitive Information

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information...

CVE-2026-95500: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

PT-2026-96762

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description SGLang is subject to a denial of service issue due to missing input validation for AUX DATA ZeroMQ control messages within the Decode worker. An unauthenticated remote attacker with network access to...

PT-2026-97083

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper authentication and missing authorization may allow a remote attacker to perform unauthorized actions. Recommendations At the moment...

CVE-2026-18172: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references...

PT-2026-97105

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Remote attackers could obtain sensitive information because the software transmits sensitive data in cleartext, which is unencrypted data se...

CVE-2026-95270: Observable Timing Discrepancy

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function checkpassword of the file changedetectionio/flaskapp.py of the component Hash Comparison. This manipulation of the argument Password causes observable timing discrepancy. The attack is possible...

CVE-2026-76716: Allocation of Resources Without Limits or Throttling

Multiple vulnerabilities exist in the Analytics and Location Engine ALE that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful...

CVE-2026-95820: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functionality of the file /dashboard/userprofile.php?section=admin1. Performing a manipulation of the argument image results in unrestricted...

ROS-20260922-73-0063

The vulnerability in Tomcat11 is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers, who operate remotely, to gain increased privileges...

CVE-2026-18176: Cleartext Transmission of Sensitive Information

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information...

VulnCheck KEV: CVE-2026-93952

Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...