CVE-2026-1213

All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2...

PT-2026-4532

Name of the Vulnerable Software and Affected Versions Firecracker versions prior to 1.13.2 and version 1.14.0 Description A flaw exists in the jailer component of Firecracker that could allow a local host user with write access to pre-created jailer directories to overwrite arbitrary host files...

CVE-2026-23755

D-Link D-View 8 versions 2.0.1.107 and below contain an uncontrolled search path vulnerability in the installer. When executed with elevated privileges via UAC, the installer attempts to load version.dll from its execution directory, allowing DLL preloading. An attacker can supply a malicious...

CVE-2025-36059 Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025

IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 006. IBM Cloud Pak for Business Automation could allow a local user with access to the container to execute OS system calls...

CVE-2026-23844 Whisper Money has IDOR Vulnerability on sync/balances endpoint

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue...

MiracleLinux 4 : microcode_ctl-1.17-33.9.AXS4 (AXEA:2018-3320:08)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXEA:2018-3320:08 advisory. - Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in...

MiracleLinux 4 : gcc-4.4.7-18.2.0.1.AXS4 (AXBA:2018-3035:03)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXBA:2018-3035:03 advisory. - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker...

CVE-2025-64691

CVE-2025-64691 affects AVEVA Process Optimization (Code Injection) where an authenticated OS-standard user can tamper TCL Macro scripts to escalate privileges to OS system, potentially fully compromising the Model Application Server. Public summaries describe local, authenticated, user-level acce...

MiracleLinux 7 : gvfs-1.36.2-3.el7 (AXSA:2019-4036:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-4036:01 advisory. gvfs: Incorrect authorization in admin backend allows privileged users to read and modify arbitrary files without prompting for password CVE-2019-3827 Tenabl...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001586)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001586 advisory. The time subsystem in the Linux kernel through 4.9.9, when CONFIGTIMERSTATS is enabled, allows local users to discover real PID values as distinguished from PID valu...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001490)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001490 advisory. A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causin...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000914)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000914 advisory. The atyfbioctl function in drivers/video/fbdev/aty/atyfbbase.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows local...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001227)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001227 advisory. Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003987)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003987 advisory. IBM Power9 AIX 7.1, 7.2, and VIOS 3.1 processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000862)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000862 advisory. The procconnectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000829)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000829 advisory. The ttysettermiosldisc function in drivers/tty/ttyldisc.c in the Linux kernel before 4.5 allows local users to obtain sensitive information from kernel memory by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001261)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001261 advisory. The printbinderrefolocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading ref...

CVE-2025-13154

An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges...

EUVD-2026-2702

An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon jdhcpd of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the...

CVE-2026-23494

Pimcore is vulnerable to insufficient function-level access control on the API that lists static routes. Prior to versions 12.3.1 and 11.5.14, an authenticated backend user lacking explicit permissions could call the endpoint (e.g., GET /api/static-routes) and retrieve internal static-route confi...