CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

Linux Distros Unpatched Vulnerability : CVE-2026-34964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for...

Linux Distros Unpatched Vulnerability : CVE-2026-34967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. A...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104559)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104559 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098781 advisory. In the Linux kernel, the following vulnerability has been resolved: be2net: Fix NULL pointer dereference in becmdgetmacfromlist When the parameter pmacidvalid argume...

Linux Distros Unpatched Vulnerability : CVE-2026-16434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098979 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to...

CentOS 9 : kernel-5.14.0-741.el9

"The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-741.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing...

Linux Distros Unpatched Vulnerability : CVE-2026-79675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM...

PT-2026-82067

Name of the Vulnerable Software and Affected Versions TarsWeb versions prior to 3.0.16 Description TarsWeb incorrectly determines if a request originates from a trusted local caller by relying on a client-controlled header. The app.js file enables the Koa proxy option without specifying trusted...

CVE-2026-75330

super-diamond-server versions prior to 1.3.4 are vulnerable to SQL injection in the front-end interface /superdiamond/preview/{projectCode}/{module}/{type}. The module parameter is directly concatenated into a SQL IN clause via StringUtils.split() and string concatenation without being parameteri...

CVE-2026-68000

MCMS

CVE-2020-15878

LibreNMS 1.65 is vulnerable to a SQL injection in the address parameter of the /ajax_table.php API endpoint. A remote authenticated attacker with normal privileges can exploit this flaw to extract the entire database contents, yielding high impact on confidentiality, integrity, and availability (...

CVE-2026-75413

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...

CVE-2026-75330

The front-end interface /superdiamond/preview/projectCode/module/type of super-diamond-server = 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split and string concatenation without being parameterized and bound...

CVE-2026-75334

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the treportsqlresource table through the ReportController.save interface and directly embedded into Hibernate native queries without any parameterization or...

PT-2026-82340

Name of the Vulnerable Software and Affected Versions community.general Ansible collection affected versions not specified Description A flaw exists in the ipa getkeytab module where the bind pw parameter, used for LDAP simple-bind passwords during Kerberos keytab retrieval, lacks the no log...

PT-2026-82217

Name of the Vulnerable Software and Affected Versions OpenMetadata versions prior to 2.0.0 Description The software accepts a caller-supplied post-authentication redirect target and appends the issued token to it. The SamlLoginServlet reads the callback request parameter and stores it in the HTTP...

PT-2026-82215

Name of the Vulnerable Software and Affected Versions one-api affected versions not specified Description An issue exists in middleware/auth.go where one of two channel-pinning paths is not properly gated. While requests using a suffix on the API key require model.IsAdmin to succeed, requests usi...

PT-2026-81970

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...