EUVD-2026-54120

Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54134

Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: High...

EUVD-2026-54263

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

EUVD-2026-54253

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used...

EUVD-2026-54260

A vulnerability was found in MZ Automation libiec61850 up to 1.6.1. The affected element is the function deleteDataSetValuesShadowBuffer of the file src/iec61850/server/mmsmapping/reporting.c of the component URCB Revalidation. The manipulation results in use after free. The attack needs to be...

EUVD-2026-54273

Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54113

Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54262

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6...

EUVD-2026-54204

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

EUVD-2024-55713

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

SUSE CVE-2026-19024

NULL pointer dereference in H5Pgetfillvalue in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and...

CVE-2026-37171

CVE-2026-37171 affects SuperTokens Core, versions 6.0.0 to 11.4.0. The root cause is a lack of tenant separation, enabling an authenticated party in one tenant to access sessions, data, and endpoints of another tenant. The CVSS 3.1 base score is 5.9 (Medium) with vectors: AV:N/AC:H/PR:L/UI:N/S:U/...

PT-2026-69132

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description The /$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. Path traversal is a technique used to access files...

Security update for perl-Mojolicious (moderate)

openSUSE Security Update: Security update for perl-Mojolicious Announcement ID: openSUSE-SU-2026:0278-1 Rating: moderate References: 1271431 Cross-References: CVE-2026-15747 CVSS scores: CVE-2026-15747 SUSE: 5.9 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N Affected Products:...

Node.js Module axios 1.7.0 < 1.18.0 maxBodyLength Bypass (CVE-2026-67317)

The version of the axios Node.js module installed on the remote host is 1.7.0 prior to 1.18.0. It is, therefore, affected by a vulnerability: - axios fails to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers ca...

Node.js Module axios 1.15.2 < 1.18.0 Prototype Pollution (CVE-2026-67314)

The version of the axios Node.js module installed on the remote host is 1.15.2 prior to 1.18.0. It is, therefore, affected by a vulnerability: - Prototype-pollution read-side gadgets in Basic auth subfield handling. When an application is already affected by a separate prototype-pollution primiti...

Linux Distros Unpatched Vulnerability : CVE-2026-71488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser ...

Fedora 43 : abrt (2026-cccf5985b5)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cccf5985b5 advisory. Update to 2.17.9 Resolves: 2484614 Resolves: CVE-2026-54230 Resolves: CVE-2026-54231 Resolves: CVE-2026-54228 Resolves: CVE-2026-54229 Tenable has...

Slackware Linux 15.0 / current p11-kit Vulnerability (SSA:2026-218-02)

The version of p11-kit installed on the remote host is prior to 0.26.5. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-218-02 advisory. New p11-kit packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-67422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors caret, tilde,...