490244 matches found
EUVD-2026-70851
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
EUVD-2026-71451
An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...
PT-2026-85430
Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
PT-2026-85417
Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
PT-2026-85429
Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
PT-2026-85428
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
PT-2026-85432
Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis. This issue affects Pik Online Portal: through 3.5.1...
CVE-2026-75163
An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...
CVE-2026-75163
The MBS-Solutions X-Serie Gateway running firmware V6_00_05 is susceptible to an information disclosure vulnerability. The ugw-deviceinfo method within /cgi-bin/wwwugw.cgi improperly returns sensitive system version fields, specifically operatingsystem and gatewayversion , to any authenticated us...
Flextype CMS 1.0.0-alpha.3 Expression Injection
Flextype CMS version 1.0.0-alpha.3 contains a stored arbitrary expression injection vulnerability in the Entries ExpressionsDirective. An authenticated remote attacker with sufficient privileges to create or modify entries can persist arbitrary expression syntax within an entry field...
Flextype CMS 1.0.0-alpha.3 Arbitrary File Read
Flextype CMS version 1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled...
PT-2026-85678
An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...
PT-2026-86238
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
Fedora 43 : chromium (2026-ee60d45695)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee60d45695 advisory. - Update to 152.0.7977.75 CVE-2026-84353: Use after free in Shared Tab Groups CVE-2026-84352: Use after free in WebGL CVE-2026-84354: Incorrect...
Fedora 43 : memcached (2026-38d8cd1c52)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-38d8cd1c52 advisory. Rebase to 1.6.45 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...
CVE-2026-67397
Plesk for Linux versions 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 are affected by a path traversal vulnerability (CVE-2026-67397) that allows local users with low privileges to execute arbitrary code as root . The vulnerability requires local access with low privileges and no user inte...
CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
CVE-2026-79992 affecting package emacs for versions less than 29.4-5
CVE-2026-79992 affecting package emacs for versions less than 29.4-5. A patched version of the package is available...
CVE-2026-85063
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
