Denx U-Boot 2026.01-rc4 Integer Overflow

Denx U-Boot versions 2026.01-rc4 and below suffer from multiple integer overflow vulnerabilities...

PT-2026-84025

Name of the Vulnerable Software and Affected Versions SliceWP versions 1.2.10 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-84014

Name of the Vulnerable Software and Affected Versions Tailored Tools versions prior to 3.0.3 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-84015

Unauthenticated Cross Site Scripting XSS in Super Store Finder = 7.10 versions...

PT-2026-84012

Unauthenticated SQL Injection in Throws SPAM Away = 3.8.2 versions...

PT-2026-84028

Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...

PT-2026-84002

Subscriber SQL Injection in Charitable = 1.8.12.1 versions...

PT-2026-84003

Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...

PT-2026-84029

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...

PT-2026-84004

Unauthenticated Cross Site Scripting XSS in Uncode = 2.12.7 versions...

PT-2026-84018

Name of the Vulnerable Software and Affected Versions Hash Form versions 1.4.2 and earlier Description An unauthenticated arbitrary file upload issue exists, allowing an attacker to upload files, such as a web shell, without requiring authentication. Recommendations Update Hash Form to a version...

PT-2026-84006

Name of the Vulnerable Software and Affected Versions Fluent Forms Pro Add On Pack versions prior to 6.2.13 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 6.2.12...

AIDE 0.19.4

AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...

PT-2026-84011

Name of the Vulnerable Software and Affected Versions Booking and Rental Manager versions prior to 2.7.7 Description Broken access control allows users with the subscriber role to perform unauthorized actions. Recommendations Update to a version newer than 2.7.6...

PT-2026-84008

Unauthenticated Cross Site Scripting XSS in LeadConnector = 4.0.5 versions...

Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...

Fedora 44 : expat (2026-b4cd43a7dc)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b4cd43a7dc advisory. Rebase to 2.8.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

OPENSUSE-SU-2026:11650-1 gopass-1.17.0-1.1 on GA media

These are all security issues fixed in the gopass-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 44 : srt (2026-b182827934)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b182827934 advisory. Update to 1.5.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

CVE-2026-82545 itsourcecode Sales and Inventory System sup_searchfrm.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/supsearchfrm.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and ma...