CVE-2026-71959

Bitwarden Server prior to 2026.7.2 is vulnerable: the service does not verify that the caller belongs to the organization in a POST /collect request, permitting an authenticated user to forge and backdate entries in any organization’s audit log. The issue affects the audit-log integrity and can u...

CVE-2026-68127

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

CVE-2026-65945 Apache Ranger: Logs contain replayable JWT bearer tokens

Logs contain replayable JWT tokens in Apache Ranger versions = 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue...

Security Bulletin: Immutable.js Denial of Service Vulnerabilities in Content Cortex for Microsoft Office

Summary Immutable.js versions before 4.3.9 and 5.1.8 have two DoS vulnerabilities CVSS 7.5, High. CVE-2026-59879 is an integer overflow in List operations set, setSize, setIn, updateIn that can cause infinite loops or unbounded memory allocation when given index/size values between 2^30 and 2^31...

CVE-2026-21081

Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-21061

Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access SIM related functions. User interaction is required for triggering this vulnerability...

CVE-2026-17020 Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure

The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, requiring only a basic read capability, allowing any authenticated user including a Subscriber or self-registered customer account to disclose...

PT-2026-69427

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database...

Photon OS 5.0: Gmp PHSA-2023-5.0-91-0146

An update of the gmp package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0146. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69870

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description The Rich Text Editor renders a chat-transcript username as HTML, which enables stor...

Photon OS 5.0: Keepalived PHSA-2026-5.0-90-0921

An update of the keepalived package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0921. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Linux PHSA-2026-5.0-92-0862

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0862. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69944

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description Dokploy, a self-hostable Platform as a Service PaaS, contains a flaw that allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server. This occurs because t...

VulnCheck KEV: CVE-2026-48294

Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...

ownsite-assessor

OwnSite Assessor Authorized defensive security assessment...

RUSTSEC-2026-0242 Safe ErrorRegistry APIs can cause undefined behavior

All published versions of dcrypt-api before 2.0.0 exposed safe ErrorRegistry operations that could trigger undefined behavior when the default std feature was enabled. Stored Box values were erased to raw pointers and later deallocated as Box. The geterror operation also performed an unchecked ca...

Fedora 44 : pgadmin4 (2026-f0550055a7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f0550055a7 advisory. Update to pgadmin-9.17. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 43 : pgadmin4 (2026-bacb14f76f)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bacb14f76f advisory. Update to pgadmin-9.17. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2026-69256

Name of the Vulnerable Software and Affected Versions NellyW8 MCP4EDA version 1.0.0 Description Command injection is possible within the run openlane/view waveform component. This occurs when the design name/vcd file argument is manipulated. Local access is required to execute this attack...