Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-52424)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2025-52862)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

SUSE: Security Advisory (SUSE-SU-2026:0121-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MiracleLinux 4 : qemu-kvm-0.12.1.2-2.355.AXS4.5 (AXSA:2013-473:03)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-473:03 advisory. KVM for Kernel-based Virtual Machine is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running...

MiracleLinux 7 : systemd-219-62.el7.5 (AXSA:2019-3771:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-3771:02 advisory. Security Fix - systemd PID1 PID1 systemd CVE-2019-6454 CVEJVNhttp://jvndb.jvn.jp/ Tenable has extracted the preceding description block directly from the...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003804)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003804 advisory. Four memory leaks in the acphwinit function in drivers/gpu/drm/amd/amdgpu/amdgpuacp.c in the Linux kernel before 5.3.8 allow attackers to cause a denial of service...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004330 advisory. In the Android kernel in F2FS touch driver there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure...

MiracleLinux 4 : qemu-kvm-0.12.1.2-2.503.AXS4.5 (AXSA:2018-2620:02)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-2620:02 advisory. Qemu: cirrus: OOB access issue in mode4and5 write functions CVE-2017-15289 Tenable has extracted the preceding description block directly from the MiracleLin...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.31 packages and security update

Red Hat OpenShift Container Platform release 4.18.31 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

Summary DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. Details When a user logs into the administrative backend, this interface can be used to delete files. The...

GHSA-VH2X-FW87-4FXQ DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

Summary DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. Details When a user logs into the administrative backend, this interface can be used to delete files. The...

CVE-2025-36911

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote proximal/adjacent information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36911

CVE-2025-36911 (WhisperPair) is a vulnerability in Google Fast Pair where devices may accept Key-Based Pairing requests even when not in pairing mode, enabling unauthorized pairing without user interaction. Connected tooling demonstrates practical exploitation: an attacker can obtain a BR/EDR add...

CVE-2026-20075

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager EPNM and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against users of the interface of an affected system. This...

CVE-2025-66292

DPanel (Go) has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. The Delete function passes the user-supplied path to storage.Local{}.GetSaveRealPath and then os.Remove without sanitizing path traversal (../), with filepath.Join in local.go resolving traversal ...

Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied inpu...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to...

CVE-2021-47771

RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can add oversized entries in Verbindungsname and Server fields to permanently freeze and crash the software, potentially requiring full...

Exploit for Unrestricted Upload of File with Dangerous Type in Greenshiftwp Greenshift_-_Animation_And_Page_Builder_Blocks

Metasploit Module: Greenshift WordPress Plugin Arbitrary File...

New Vulnerability in n8n

This isn't good: We discovered a critical vulnerability CVE-2026-21858, CVSS 10.0 in n8n that enables attackers to take over locally deployed instances, impacting an estimated 100,000 servers globally. No official workarounds are available for this vulnerability. Users should upgrade to version...