PT-2026-70195

A vulnerability has been identified in Siemens License Server SLS All versions V5.1. The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to...

Security Update for Microsoft Power BI Report Server (August 2026)

The Microsoft Power BI Report Server on the remote host is missing the February 2026 security update. It is, therefore, affected by an RCE vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 809...

KB5120386: Windows Server 2012 Security Update (August 2026)

The remote Windows host is missing security update 5120386. It is, therefore, affected by multiple vulnerabilities - Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. CVE-2026-62878 - Use after free in Windows Deployment Services allows an...

KLA91211 ACE vulnerability in Microsoft SQL Server

Arbitrary code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-65811 Exploitation Related products Microsoft-Power-BI CVE list CVE-2026-65811 critical KB list Solution Install necessa...

mcp-server-kubernetes 3.8.x - Argument Injection

!/usr/bin/env python3 Exploit Title: mcp-server-kubernetes 3.8.x - Argument Injection CVE: CVE-2026-61459 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author GitHub: https://github.com/mbanyamer Author Blog :...

August 11, 2026-KB5121645 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10, version 1809 and Windows Server 2019

None None...

CVE-2025-30237

The CVE-2025-30237 entry describes an authentication bypass on TP-Link Aginet devices caused by improper enforcement of access control in the device web management interface. The vulnerability affects the web server’s endpoints where authentication checks are not consistently enforced, enabling a...

CVE-2025-30237 Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid...

CVE-2026-68083

A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated client could exploit a path resolution error, specifically in the ksmbdvfskernpathcreate function. This vulnerability allows a client to use ".." components in a path to escape the intended...

CVE-2026-72911

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-18948

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-18941

A flaw was found in Feast and feast-operator. The default configuration for both the Feast SDK and the feast-operator is "noauth," meaning no security manager is installed. This default allows unauthenticated and unauthorized access to feature-server, registry-server, and offline-server endpoints...

CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-72911 ERPNext: Possibility of server-side template injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validatetemplate and rendertemplate calls in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py render subject, body, and pdfname fields with unrestricted globals...

CVE-2026-72911

ERPNext has a server-side template injection vulnerability affecting the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. Unrestricted globals (including frappe.utils) allow an authenticated user with a common ...

GHSA-55Q2-FJHQ-7XH7 vulnerabilities

Vulnerabilities for packages: nextcloud-server, langfuse...

CVE-2026-18948 Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

EUVD-2026-55818

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...

CVE-2026-18948

Feast: A flaw in serializing UDFs with dill enabling unsafe deserialization leads to unauthenticated RCE on the feature server and, via deserialization bypass, on the registry server. A remote attacker can store a malicious UDF, with the risk of cross-tenant data access and lateral movement in de...

CVE-2026-18948 Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server

A flaw was found in Feast. The system improperly deserializes user-defined functions UDFs stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in...