CVE-2026-84939

Apache FreeMarker versions 2.2.0 through 2.3.34 are vulnerable to a path traversal vulnerability in the template loading mechanism. This flaw occurs when an attacker provides a specially crafted, malformed locale identifier while the localized lookup configuration setting is enabled (which is the...

CVE-2026-87933

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtilsMergePatch of the file cJSONUtils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to...

PT-2026-89369

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

PT-2026-89371

Name of the Vulnerable Software and Affected Versions Capgo affected versions not specified Description Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, which leaves stale overrides active. This allows attackers to retain channel-specif...

CVE-2026-52098

Flowise version 3.1.2 is vulnerable to Remote Code Execution (RCE) , as identified in CVE-2026-52098. A remote attacker can exploit an issue involving the improper control of generation of code to execute arbitrary commands via the /api/v1/prediction/ endpoint. This vulnerability requires no auth...

PT-2026-89439

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

PT-2026-89465

Name of the Vulnerable Software and Affected Versions Dell ThinOS 10 versions prior to 2605 10.2616 Description An issue exists where the Security Version Number is mutable to older versions. A low privileged attacker with physical access to the device could exploit this to bypass protection...

PT-2026-89300

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

PT-2026-89429

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

PT-2026-89437

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

PT-2026-89434

Unauthenticated Broken Authentication in IMPress for IDX Broker = 3.3.0 versions...

PT-2026-89435

Subscriber Broken Access Control in IMPress for IDX Broker = 3.3.0 versions...

PT-2026-89447

Unauthenticated Privilege Escalation in SiteSkite = 2.1.5 versions...

PT-2026-89430

Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...

PT-2026-89443

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

CVE-2026-81051: Security Version Number Mutable to Older Versions

Dell ThinOS 10, versions prior to 260510.2616, contain a Security Version Number Mutable to Older Versions vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

PT-2026-89432

Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...

PT-2026-89428

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-88860: Incorrect Authorization

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...

Fedora 43 : openssl (2026-00b3d3d018)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-00b3d3d018 advisory. Rebase to OpenSSL 3.5.8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...