PT-2026-54462

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'wppm proj filter' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of...

Fedora 44 : transmission (2026-23d0f010f8)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-23d0f010f8 advisory. Fix qt icon Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue...

PT-2026-55564

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, the Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could se...

PT-2026-55210

Name of the Vulnerable Software and Affected Versions @jshookmcp/jshook version 0.3.1 Description The network domain implements a central Server-Side Request Forgery SSRF authorization policy designed to block private, loopback, link-local, and reserved targets unless explicit authorization is...

PT-2026-54887

Name of the Vulnerable Software and Affected Versions ThumbPress versions prior to 6.3.2 Description Missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to a version newer than 6.3.2...

PT-2026-54809

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the may decode fh function. The function accesses mount::mnt ns without holding necessary locks, allowing a mount to be concurrently unmounted and th...

Fedora 43 : hut (2026-32113d4817)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-32113d4817 advisory. Update! - Close Go standard library CVE bugs that are solved by a rebuild Tenable has extracted the preceding description block directly from the...

Fedora 44 : hut (2026-ed208f5337)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ed208f5337 advisory. Update! - Close Go standard library CVE bugs that are solved by a rebuild Tenable has extracted the preceding description block directly from the...

Fedora 43 : opkssh (2026-12d4cde449)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-12d4cde449 advisory. Update bundled golang.org/x/crypto to 0.53.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora 43 : thunderbird (2026-2fb5ca48a2)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2fb5ca48a2 advisory. Update to latest upstream version ---- Update to latest upstream version. Tenable has extracted the preceding description block directly from the...

DEBIAN-CVE-2026-14154

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2026-58448

yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected endpoint lacking the @PreAuthorize annotation...

CVE-2026-50254

CVE-2026-50254 affects the DCMTK toolkit’s storescp component. An unauthenticated remote attacker can repeatedly send a crafted connection request, causing a memory leak that grows quickly in the default single-process mode, ultimately killing the service and requiring an operator to restart it. ...

CVE-2025-36324

CVE-2025-36324 affects IBM watsonx.data intelligence versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0. The issue is a server-side request forgery (SSRF) that could allow an authenticated attacker to make unauthorized requests from the system, potentially enabling network enumeration or facilitating other ...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition through the payWithCredit process. An attacker can bypass credit balance restrictions by sending concurrent payment requests, resulting in multiple invoices being paid using the same credit balance. Remediation Upgrade...

GHSA-QCM7-3VPR-HJ5H @adonisjs/bodyparser has an incomplete fix for CVE-2026-25754

Summary The fix for GHSA-f5x2-vj4h-vg4c / CVE-2026-25754 introduced in commit 40e1c71 is incomplete and can be bypassed through nested prototype pollution payloads. The original patch replaced the internal FormFields storage object with Object.createnull, preventing direct payloads such as...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in the saferedirect process. An attacker can redirect users to an external domain by crafting a malicious continue parameter or embedding a malicious URL in a session-transfer token, which can be interpreted by browsers as...

CVE-2026-14178

openGauss 在处理带 NLS 参数的 totimestamp 调用时，totimestampwithfmtnls 会将 nlsfmtstr 保存到 usess-parsercxt.nlsfmtstr。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan 的表达式上下文中；当 SeqScan 完成后，该内存上下文会被 reset，但后续结果输出阶段 timestampout 仍会通过 CheckNlsFormat 访问 usess-parsercxt.nlsfmtstr，导致访问已释放内存。攻击者在具备数据库 SQL 执行权限的情况下，可构造特定...

Incorrect Calculation of Buffer Size

Overview org.apache.activemq:apache-activemq is a Message Broker and Client implementations. Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size via the STOMP protocol when a remote unauthenticated peer sends a negative content-length value. An attacker can...

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474

Severity - High Description of Problem Multiple vulnerabilities have been discovered in NetScaler ADC formerly Citrix ADC and NetScaler Gateway formerly Citrix Gateway. Refer below for further details. Affected Versions: The following supported versions of NetScaler ADC and NetScaler Gateway are...