EUVD-2026-49110

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In doaction's UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases, the memmove destination is Add2Ptre, le16tocpue-view.dataof...

CVE-2026-64532

Summary: CVE-2026-64532 affects the Linux kernel ntfs3 path. Filesystem code in UpdateRecordDataRoot/UpdateRecordDataAllocation bound checks for on-disk NTFS_DE view.data_off are missing when memmoving data, allowing potential out-of-bounds writes. The issue arises because memmove destinations us...

CVE-2026-64532

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFSDE view.dataoff in UpdateRecordDataRoot,Allocation In doaction's UpdateRecordDataRoot fslog.c:3489 and UpdateRecordDataAllocation fslog.c:3697 cases, the memmove destination is Add2Ptre, le16tocpue-view.dataof...

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

WordPress Download Manager plugin < 3.3.62 - Unauthorized Protected File Download vulnerability

Unauthorized Protected File Download vulnerability discovered by Alessandro Greco aka Aleff, Giovanbattista Ianni University of Calabria - UNICAL in WordPress Plugin Download Manager versions 3.3.62...

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...

BIT-OPENBAO-2025-52893 OpenBao May Leak Sensitive Information in Logs When Processing Malformed Data

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. Th...

CVE-2026-48369

creationtimestamp| type| source ---|---|--- 2026-07-27 03:27:22+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrlxai5myw2u 2026-07-27 03:27:24+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mrlxajqsw32s 2026-07-27 03:42:37+00:00| seen|...

[SECURITY] Fedora 43 Update: skopeo-1.22.2-2.fc43

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

PT-2026-65320

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.4 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update GiveWP to version 4.16...

PT-2026-64963

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

PT-2026-64971

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

PT-2026-65255

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Tahoe versions prior to 26.6 Description A buffer overflow occurs during the processing of a 3D model, which may lead to the disclosure of...

PT-2026-64853

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

PT-2026-65318

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Contact Form 7 versions prior to 3.5.46 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...

CVE-2025-63913

An issue was discovered in OpenSBI version 1.3 that allows attackers to cause a denial of service (DoS). The vulnerability is triggered by sending a crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of the SBI PMU (Performance Monitoring Unit) extensio...

CVE-2026-51298

sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree, the program still accesses internal member of the freed pointer, which can cause service crash and denial of service...

Fedora 43 : skopeo (2026-4d9a2870e5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d9a2870e5 advisory. Security fix for CVE-2026-27145 Go stdlib crypto/x509 DoS vulnerability. Rebuild with golang-1.25.12 which includes the fix. Tenable has extracted the...

openSUSE 16: libopenssl-3-devel / libopenssl-3-fips-provider / etc (openSUSE-SU-2026:21443-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21443-1 advisory. This update for openssl-3 fixes the following issue: - HollowByte DoS via attacker-controlled memory allocation bsc1271712. Tenable has extracted the...

Fedora 43 : systemd (2026-289c38d6f2)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-289c38d6f2 advisory. Latest upstream bugfix release. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...