PT-2026-103087

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course without proper permission,...

Kibana 8.x < 8.19.22 / 9.4.x < 9.4.6 Incorrect Authorization (ESA-2026-103)

The version of Kibana installed on the remote host is 8.x prior to 8.19.22, or 9.4.x prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-103 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized disclosure,...

CVE-2026-102139: Authorization Bypass Through User-Controlled Key

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of...

CVE-2026-102149: Missing Authentication for Critical Function

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

CVE-2026-102585: Placement of User into Incorrect Group

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

Important: pki-core security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogtag PKI v2 REST ACL...

PT-2026-103178

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-102584: Direct Request

A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessme...

RHEL 9 : pki-core (RHSA-2026:73766)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73766 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core:...

CVE-2026-102583: Direct Request

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI...

PT-2026-102967

Name of the Vulnerable Software and Affected Versions AiSOC versions 5.1.0 through 11.9.9 Description An authentication bypass exists in the realtime service internal endpoints 'POST /internal/agent-event' and 'POST /internal/push'. This allows attackers to submit arbitrary events using spoofed...

PT-2026-103096

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. CSRF is a flaw that allows an attacker to trick an authenticated user into performing actions they d...

CVE-2026-102588: Origin Validation Error

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

The vulnerability of the OpenVPN module of TP-Link Archer AX53 router software allows a intruder to gain unauthorized access to protected information.

The vulnerability of the OpenVPN module of TP-Link Archer AX53 networking hardware is related to errors in system settings or configuration. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information using a specially crafted file...

The vulnerability of the OpenVPN module of TP-Link Archer AX53 router software allows a intruder to gain unauthorized access to protected information.

The vulnerability of the OpenVPN module of TP-Link Archer AX53 networking hardware is related to errors in system settings or configuration. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information using a specially crafted file...

AlmaLinux 9.2 [TuxCare] Security Update: pam / pam-devel / pam-docs (ALMALINUX9.2:CLSA-2024:1735300164)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1735300164 advisory. - A flaw was found in pamaccess, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows...

CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1788956505)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1788956505 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1789029795)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1789029795 advisory. - Rsync versions before 3.4.3 contain a time-of-check to time-of-use TOCTOU race condition in daemon file handling that allows attackers...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788953354)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788953354 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root...

AlmaLinux 8 : nodejs:22 (ALSA-2026:62219)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62219 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...