Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP Module Improper Resource Shutdown or Release (CVE-2026-1875)

Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service DoS condition on the products by continuously sending UDP packets to the...

Oracle Linux 7 : PackageKit (ELSA-2026-22146)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-22146 advisory. 1.1.10-2.0.3 - Backport fix for CVE-2026-41651 Orabug: 39467887 Tenable has extracted the preceding description block directly from the Oracle Linux security...

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library allows a hacker to bypass existing security mechanisms.

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library is related to the use of the outdated cryptographic algorithm SHA-1. Exploiting this vulnerability allows a remote attacker to bypass existing security measures...

The vulnerability of the th1520_aon_power_update() function in the drivers/firmware/thead module, located in the Linux kernel-based firmware, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the th1520aonpowerupdate function in the drivers/firmware/thead module, within the th1520-aon.c driver for Linux kernel patches, is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability...

CVE-2026-51953

An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

PT-2026-66875

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

PT-2026-66862

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import module class helper within sentence transformers/util/misc.py, where the guard condition includes an 'or os.path.existsmodel na...

The vulnerability of the ulpi_register_interface() function in the drivers/usb/common/ulpi.c module of the Linux operating system’s USB device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ulpiregisterinterface function in the drivers/usb/common/ulpi.c module of the Linux device driver framework is related to the multiple release of the same resource or descriptor. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the buildid_show() function in the drivers/xen/privcmd.c file of the Linux kernel device driver module allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the buildidshow function in the drivers/xen/privcmd.c module of the Linux kernel device driver library is related to the re-release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability in the net/netfilter/nf_conntrack_netlink.c module of the Linux kernel’s netfilter component allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability in the net/netfilter/nfconntracknetlink.c module of the Linux kernel’s netfilter component is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected...

The vulnerability of the tpacket_snd() function in the net/packet/af_packet.c module of the Linux kernel allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tpacketsnd function in the net/packet/afpacket.c module of the Linux kernel is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the usbtmc_release() function in the drivers/usb/class/usbtmc.c module of the Linux operating system’s USB device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the usbtmcrelease function in the drivers/usb/class/usbtmc.c module of the Linux device driver framework is related to the pointer being reclaimed after its expiration. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

javapackages-tools:201801 security update

ant-contrib 1.0-0.32.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 1.0-0.31.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora27MassRebuild 1.0-0.30.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora26MassRebuild 1.0-0.29.b3 - Rebuilt for...

MiracleLinux 9 : python3.14-3.14.5-1.el9_8 (AXSA:2026-1397:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1397:02 advisory. python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open API CVE-2026-4786 python: Python: Cross-Site Scripting XS...

📄 velocityjs 2.1.5 Prototype Pollution

A proof of concept exploit for velocityjs versions 0.3.1 through 2.1.5 that contain a prototype pollution vulnerability. The exploit abuses an unvalidated set left-hand path to write arbitrary properties into Object.prototype, enabling authorization bypasses and, on Node.js 16 and earlier,...

MAL-2026-11317 Malicious code in host-inspector-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94f6b6fa0236d92aa637686aea23b70cb31900bb701c70d77397fd3da25f2bd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dsilva-react-module-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e6a8391609d3660eb97edc5c301beb1c8d644032e8387a33513121c2bcf70da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in host-inspector-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94f6b6fa0236d92aa637686aea23b70cb31900bb701c70d77397fd3da25f2bd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11283 Malicious code in dsilva-react-module-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e6a8391609d3660eb97edc5c301beb1c8d644032e8387a33513121c2bcf70da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...