CVE-2026-84905

The Eventin WordPress plugin (versions before 4.1.24 ) is vulnerable to a privilege escalation flaw because it fails to verify user capabilities when adding a speaker. This allows users with contributor-level access or higher to create new WordPress user accounts with elevated permissions, such a...

EUVD-2026-80177

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-12793 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface uAPI that cause an internal error. This issue arises when Work Queues WQs are specified to share the...

EUVD-2026-80069

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

EUVD-2026-80068

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...

EUVD-2025-210915

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

CVE-2026-15639

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...

CVE-2026-15640

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user...

PT-2026-93344

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...

Oracle Linux 8 : tesseract (ELSA-2026-67832)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-67832 advisory. 4.1.1-3 - Resolves: CVE-2026-73066 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

Linux Distros Unpatched Vulnerability : CVE-2026-41573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection passes the queryId parameter from...

GitLab 15.7 < 19.1.8 / 19.2 < 19.2.6 / 19.3 < 19.3.2 (CVE-2026-13210)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an...

Linux Distros Unpatched Vulnerability : CVE-2026-44202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the /sessionservice addSessionListener operation allows an authenticated user t...

PT-2026-93348

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

PT-2026-93315

The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attributed to, allowing any board member to post comments that appear to be authored by another user, including administrators...

CVE-2026-92750: Missing Authorization

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

CVE-2026-92592: Improper Neutralization of Special Elements Used in a Template Engine

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-92589: Missing Authorization

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...