https://www.tenable.com/cve/feeds?sort=newest Get the latest CVE updates from Tenable Tue, 22 Sep 2026 20:38:57 GMT https://validator.w3.org/feed/docs/rss2.html Tenable CVEs https://www.tenable.com/themes/custom/tenable/img/favicons/apple-touch-icon.png https://www.tenable.com/cve/feeds?sort=newest Copyright 2026 Tenable, Inc. All rights reserved. https://www.tenable.com/cve/CVE-2026-94627 https://www.tenable.com/cve/CVE-2026-94627 Mon, 21 Sep 2026 22:17:01 GMT High Severity

Description

vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when concurrent child requests share a single transfer ID in prefill/decode disaggregated deployments. Attackers can trigger GPU memory exhaustion by submitting completion requests with multiple prompts, causing orphaned KV cache blocks to accumulate until process restart and eventually preventing legitimate requests from executing.

Read more at https://www.tenable.com/cve/CVE-2026-94627

]]> https://www.tenable.com/cve/CVE-2026-94626 https://www.tenable.com/cve/CVE-2026-94626 Mon, 21 Sep 2026 22:17:01 GMT High Severity

Description

vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatible completion endpoints, allowing attackers to allocate unbounded memory. Attackers can supply arbitrary tp_size values in prefill/decode disaggregated deployments to exhaust memory and trigger kernel OOM-kill of the decode worker process.

Read more at https://www.tenable.com/cve/CVE-2026-94626

]]> https://www.tenable.com/cve/CVE-2026-94625 https://www.tenable.com/cve/CVE-2026-94625 Mon, 21 Sep 2026 22:17:01 GMT Medium Severity

Description

vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected prefill requests create ownerless transfer placeholders that are never reclaimed. Attackers can send rejected requests to exhaust sender task pools, causing valid requests to be delayed by up to 480 seconds while health checks continue returning success.

Read more at https://www.tenable.com/cve/CVE-2026-94625

]]> https://www.tenable.com/cve/CVE-2026-94624 https://www.tenable.com/cve/CVE-2026-94624 Mon, 21 Sep 2026 22:17:01 GMT High Severity

Description

vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingConnector is configured with TieringOffloadingSpec and a peer-to-peer secondary tier. Attackers can supply arbitrary remote host and port values in kv_transfer_params to create unreachable peer sessions that retain ZeroMQ sockets until the context quota is exhausted, causing an uncaught ZMQError that crashes EngineCore and stops all inference.

Read more at https://www.tenable.com/cve/CVE-2026-94624

]]> https://www.tenable.com/cve/CVE-2026-94623 https://www.tenable.com/cve/CVE-2026-94623 Mon, 21 Sep 2026 22:17:01 GMT High Severity

Description

vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix caching implementation that fails to properly validate block counts across multi-prompt completion requests in prefill/decode disaggregated deployments. Attackers can trigger an assertion failure in NixlBaseConnectorWorker._apply_prefix_caching by submitting completion requests with multiple prompts of varying lengths, causing the decode worker to terminate and become unavailable until restarted.

Read more at https://www.tenable.com/cve/CVE-2026-94623

]]> https://www.tenable.com/cve/CVE-2026-94622 https://www.tenable.com/cve/CVE-2026-94622 Mon, 21 Sep 2026 22:17:00 GMT High Severity

Description

vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metadata handling for prefill/decode disaggregated deployments. Attackers can send requests with incomplete kv_transfer_params dictionary entries to trigger an uncaught KeyError in EngineCore scheduling, causing the decode engine to terminate and making all routed requests fail until manual restart.

Read more at https://www.tenable.com/cve/CVE-2026-94622

]]> https://www.tenable.com/cve/CVE-2026-94540 https://www.tenable.com/cve/CVE-2026-94540 Mon, 21 Sep 2026 22:17:00 GMT High Severity

Description

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local service without any pairing confirmation or user interaction. Attackers can exploit the unauthenticated local service through same-device loopback to perform privileged SMS operations using the victim application's permissions.

Read more at https://www.tenable.com/cve/CVE-2026-94540

]]> https://www.tenable.com/cve/CVE-2026-94536 https://www.tenable.com/cve/CVE-2026-94536 Mon, 21 Sep 2026 22:17:00 GMT Medium Severity

Description

lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employees' role codes, permission codes, and complete front-end router trees without authorization checks.

Read more at https://www.tenable.com/cve/CVE-2026-94536

]]> https://www.tenable.com/cve/CVE-2026-94535 https://www.tenable.com/cve/CVE-2026-94535 Mon, 21 Sep 2026 22:17:00 GMT High Severity

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.

Read more at https://www.tenable.com/cve/CVE-2026-94535

]]> https://www.tenable.com/cve/CVE-2026-94534 https://www.tenable.com/cve/CVE-2026-94534 Mon, 21 Sep 2026 22:17:00 GMT High Severity

Description

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

Read more at https://www.tenable.com/cve/CVE-2026-94534

]]> https://www.tenable.com/cve/CVE-2026-94533 https://www.tenable.com/cve/CVE-2026-94533 Mon, 21 Sep 2026 22:17:00 GMT High Severity

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to the /anyone/file/down and /anyone/file/download endpoints, as the application never validates file ownership against the created_by column.

Read more at https://www.tenable.com/cve/CVE-2026-94533

]]> https://www.tenable.com/cve/CVE-2026-94532 https://www.tenable.com/cve/CVE-2026-94532 Mon, 21 Sep 2026 22:17:00 GMT High Severity

Description

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresses, national identity card numbers, and WeChat and DingTalk OpenIDs.

Read more at https://www.tenable.com/cve/CVE-2026-94532

]]> https://www.tenable.com/cve/CVE-2026-93340 https://www.tenable.com/cve/CVE-2026-93340 Mon, 21 Sep 2026 22:16:59 GMT High Severity

Description

Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain valid password reset tokens for any account by exploiting the client-supplied origin parameter in the forgot_password endpoint without server-side validation. Attackers can send a crafted request specifying an attacker-controlled origin, causing the victim to receive a poisoned reset link that discloses the session token to the attacker, enabling full account takeover including administrator accounts.

Read more at https://www.tenable.com/cve/CVE-2026-93340

]]> https://www.tenable.com/cve/CVE-2026-88756 https://www.tenable.com/cve/CVE-2026-88756 Mon, 21 Sep 2026 22:16:59 GMT Critical Severity

Description

Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).

Read more at https://www.tenable.com/cve/CVE-2026-88756

]]> https://www.tenable.com/cve/CVE-2026-88738 https://www.tenable.com/cve/CVE-2026-88738 Mon, 21 Sep 2026 22:16:59 GMT High Severity

Description

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An authenticated attacker can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be accessed directly over HTTP without authentication, resulting in remote code execution.

Read more at https://www.tenable.com/cve/CVE-2026-88738

]]> https://www.tenable.com/cve/CVE-2026-79079 https://www.tenable.com/cve/CVE-2026-79079 Mon, 21 Sep 2026 22:16:59 GMT High Severity

Description

An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components

Read more at https://www.tenable.com/cve/CVE-2026-79079

]]> https://www.tenable.com/cve/CVE-2026-78847 https://www.tenable.com/cve/CVE-2026-78847 Mon, 21 Sep 2026 22:16:58 GMT Critical Severity

Description

An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter when language is js/javascript.This allows arbitrary code execution.

Read more at https://www.tenable.com/cve/CVE-2026-78847

]]> https://www.tenable.com/cve/CVE-2026-78806 https://www.tenable.com/cve/CVE-2026-78806 Mon, 21 Sep 2026 22:16:58 GMT Medium Severity

Description

An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component

Read more at https://www.tenable.com/cve/CVE-2026-78806

]]> https://www.tenable.com/cve/CVE-2026-65980 https://www.tenable.com/cve/CVE-2026-65980 Mon, 21 Sep 2026 22:16:58 GMT High Severity

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables() from server/sources/shared/sql/sql.variables.js without enabling the escapeBackslash option. For a ClickHouse-backed chart with variable binding, an attacker can supply a backslash before a quote so quote doubling does not keep the value within its intended SQL string literal. Public dashboards can expose this path without authentication, and successful exploitation can execute arbitrary ClickHouse SQL to disclose data or, when the database configuration permits, access files or internal network resources. This issue is fixed in version 5.2.3.

Read more at https://www.tenable.com/cve/CVE-2026-65980

]]> https://www.tenable.com/cve/CVE-2026-61852 https://www.tenable.com/cve/CVE-2026-61852 Mon, 21 Sep 2026 22:16:58 GMT Medium Severity

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's row_limit parameter into a SQL LIMIT clause without runtime integer validation. The read-only keyword check runs before this value is appended, so an authenticated user who can influence a model-generated non-integer row_limit can add SQL that bypasses the earlier check. Successful exploitation can execute arbitrary statements against the connected database, including reading or changing data and, where database permissions permit, accessing files or executing operating-system commands. This issue is fixed in version 5.2.2.

Read more at https://www.tenable.com/cve/CVE-2026-61852

]]> https://www.tenable.com/cve/CVE-2026-61851 https://www.tenable.com/cve/CVE-2026-61851 Mon, 21 Sep 2026 22:16:58 GMT Medium Severity

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist containing only seven SQL keywords. An authenticated user with AI feature access can submit dangerous statements or database functions that are absent from the read-only keyword blocklist, causing them to execute without SQL injection or keyword-obfuscation techniques. Depending on the database engine, configuration, and database-user privileges, this can expose or write files, access internal network resources, change database privileges, execute commands, or alter data. This issue is fixed in version 5.2.2.

Read more at https://www.tenable.com/cve/CVE-2026-61851

]]> https://www.tenable.com/cve/CVE-2026-61743 https://www.tenable.com/cve/CVE-2026-61743 Mon, 21 Sep 2026 22:16:57 GMT Medium Severity

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl() to resolve and validate a target hostname, but request-promise performs a separate DNS resolution for the actual connection. An authenticated user who can create or test API connections and controls the target DNS name can return a public address during validation and a private address during the request, bypassing the protections implemented by server/modules/outboundTargetPolicy.js. This DNS rebinding condition can expose internal services, localhost resources, or cloud metadata endpoints. This issue is fixed in version 5.2.2.

Read more at https://www.tenable.com/cve/CVE-2026-61743

]]> https://www.tenable.com/cve/CVE-2026-61652 https://www.tenable.com/cve/CVE-2026-61652 Mon, 21 Sep 2026 22:16:57 GMT High Severity

Description

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit (`iter_bytes(chunk_size=...)`) or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compressed response could overflow memory. Version 0.14.0 contains a patch. Some workarounds are available. Read the still-compressed body with `Response.iter_raw()` / `Response.async_iter_raw()`, which bypass the built-in decoders, and decompress it yourself with an explicit output-size bound (e.g. `zlib`'s `max_length`), aborting once a configured limit is exceeded. Where feasible, send `Accept-Encoding: identity` to disable response compression so bodies are not decompressed client-side. Avoid decoding response bodies from untrusted servers.

Read more at https://www.tenable.com/cve/CVE-2026-61652

]]> https://www.tenable.com/cve/CVE-2026-61541 https://www.tenable.com/cve/CVE-2026-61541 Mon, 21 Sep 2026 22:16:57 GMT Medium Severity

Description

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained `Content-Encoding` values causes Zapros to construct a deeply nested decompression chain that consumes excessive resources. Version 0.14.0 patches the vulnerability by limiting responses to five content-encoding layers and raising `DecodingError` when that limit is exceeded. As a workaround, applications can add response middleware that inspects the `Content-Encoding` header and rejects responses containing more than a safe number of encoding layers.

Read more at https://www.tenable.com/cve/CVE-2026-61541

]]> https://www.tenable.com/cve/CVE-2026-59830 https://www.tenable.com/cve/CVE-2026-59830 Mon, 21 Sep 2026 22:16:57 GMT Medium Severity

Description

Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.

Read more at https://www.tenable.com/cve/CVE-2026-59830

]]> https://www.tenable.com/cve/CVE-2026-59815 https://www.tenable.com/cve/CVE-2026-59815 Mon, 21 Sep 2026 22:16:57 GMT Medium Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed() authorizes writes to items with a share ID when any share_users row exists for the caller, without requiring ShareUserStatus.Accepted. A low-privileged authenticated user with a pending folder-share invitation can create an item under the share ID, and ShareModel.updateSharedItems3() propagates the injected content to the owner and accepted participants before the attacker accepts the invitation. This issue is fixed in version 3.7.7.

Read more at https://www.tenable.com/cve/CVE-2026-59815

]]> https://www.tenable.com/cve/CVE-2026-59814 https://www.tenable.com/cve/CVE-2026-59814 Mon, 21 Sep 2026 22:16:57 GMT High Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's GET /shares/:id?resource_id= route serves a resource with the attacker-controlled mime value and omits Content-Disposition when the resource title is empty. A low-privileged user can publish an empty-title image/svg+xml attachment whose script executes when a victim opens the public share. By default, user content shares the Joplin Server application origin, allowing the script to access same-origin data and, when the victim is authenticated, perform actions with the victim's session, including reading administrative data and anti-CSRF tokens. Installations that configure USER_CONTENT_BASE_URL to a separate origin still execute the script, but on that separate user-content origin rather than the application origin. This issue is fixed in version 3.7.7.

Read more at https://www.tenable.com/cve/CVE-2026-59814

]]> https://www.tenable.com/cve/CVE-2026-55210 https://www.tenable.com/cve/CVE-2026-55210 Mon, 21 Sep 2026 22:16:56 GMT High Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's UserModel.ssoLogin() returns an existing account matched by an IdP-asserted email without checking the account's is_external flag. In deployments using mixed local and SAML authentication, an attacker whose IdP session can assert a local user's email can pass POST /api/saml, receive a session for that local account, and access or modify the victim's notes, files, and settings without knowing the local password. This issue is fixed in version 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-55210

]]> https://www.tenable.com/cve/CVE-2026-46650 https://www.tenable.com/cve/CVE-2026-46650 Mon, 21 Sep 2026 22:16:56 GMT Medium Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl() in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character path fragment to pass validation and be emitted into an HTML note's link. A low-privileged Joplin Server user can publish the crafted HTML note as a public share. In the current build, ordinary left-click is blocked; demonstrated execution requires middle-click or Open in new tab in an older or non-hardened browser because current Chrome and Firefox block javascript: new-tab navigation. When execution succeeds, the script runs in the Joplin Server origin, can read page-visible content, and can make authenticated same-origin requests when the victim is signed in. This issue is fixed in version 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-46650

]]> https://www.tenable.com/cve/CVE-2026-17054 https://www.tenable.com/cve/CVE-2026-17054 Mon, 21 Sep 2026 22:16:56 GMT Medium Severity

Description

The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_event_task(). For control frames it took the 16-bit TLV field data_length straight off the wire and passed it to pb_istream_from_buffer(frame.data_value, frame.data_length) without checking it against the frame length or the receive buffer. frame.data_value sits 26 bytes into a 3188-byte stack object, so a data_length of up to 0xFFFF makes pb_decode() read up to roughly 62 KB past the end of that object. Only the first fragment of a fragmented control response carries a TLV header; the pre-fix driver performed half-duplex SPI transactions and silently discarded any frame the co-processor queued while the host was transmitting (esp_hosted_hal_spi_transfer() aliased the RX buffer onto the TX buffer). When the discarded frame is the first fragment of a fragmented response, the driver treats the next fragment as a new frame — its per-fragment header and checksum are genuine, so both validation steps pass — and reads the TLV header out of raw protobuf continuation bytes. Those bytes come from control responses whose size and content an adjacent, unauthenticated attacker can influence, notably the AP scan list, which grows with the number and SSID length of access points in radio range. The impact is denial of service rather than disclosure. Reading past the end of the RAM region faults the device, and CONFIG_NANOPB_ENABLE_MALLOC is selected by the driver, so garbage length prefixes read out of bounds also drive heap allocations. The out-of-bounds bytes themselves do not reach the application: pb_decode() is started mid-stream on raw protobuf continuation bytes and so almost always fails outright, and anything that did decode would still have to pass esp_hosted_response(), which requires an exact msg_id match against the pending request, and then esp_hosted_ctrl_response(), which requires a success resp — an attacker influences the size and content of legitimate control responses, not the structure decoded out of misaligned bytes. Two related defects in the same receive path make the denial of service permanent: the fragment reassembly guard was sized with ESP_FRAME_SIZE instead of ESP_FRAME_MAX_PAYLOAD and, when tripped, returned from the sole RX thread instead of dropping the frame, and unhandled control events were queued with k_msgq_put(..., K_FOREVER) on an eight-entry queue that nothing drains, blocking that same thread. The driver has no watchdog or restart path, so either condition ends all Wi-Fi reception until the device is rebooted.

Read more at https://www.tenable.com/cve/CVE-2026-17054

]]> https://www.tenable.com/cve/CVE-2026-15890 https://www.tenable.com/cve/CVE-2026-15890 Mon, 21 Sep 2026 22:16:56 GMT Medium Severity

Description

The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/aead_get.c, stores its nonce counter in unsynchronized function-local static variables (s_nonce and s_nonce_initialized). Every ITS write obtains its AES-GCM or ChaCha20-Poly1305 nonce here via secure_storage_its_transform_to_store(). Because the function held no lock, two threads calling it concurrently race on the shared statics: the initialization path (psa_generate_random() followed by memcpy()) and the non-atomic increment-then-copy path can each hand the same nonce value to two distinct encryption operations, and can lose increments so the counter repeats values it was designed never to repeat. The ITS layer (secure_storage_its_set() in subsys/secure_storage/src/its/implementation.c) performs no serialization of its own, so concurrent same-UID writes reach the racy provider directly. Reusing a nonce with the same key under AES-GCM or ChaCha20-Poly1305 is a catastrophic AEAD failure: it leaks the XOR of the two plaintexts (ITS routinely stores secrets, including PSA persistent keys) and, for GCM, exposes the authentication key, enabling forgery of stored entries. Because the AEAD key is derived per entry UID, the security-relevant collision is two concurrent writes to the same UID both receiving the same nonce; an adversary able to read the raw backing storage can then exploit the reuse. Both ITS store back-ends shipped with Zephyr, zms.c and the settings/NVS back-end in settings.c, are log-structured flash stores with deferred garbage collection, so an entry superseded by a rewrite remains physically present in the partition until its sector is reclaimed. Two same-UID writes that race therefore leave both ciphertexts readable in the raw image at once, which is the condition the nonce reuse needs to be exploitable. The trigger remains narrow: both built-in key providers (DEVICE_ID_HASH and ENTRY_UID_HASH) salt the derived key with the entry UID, so reuse across different UIDs is harmless, and the exposure requires an application that writes the same UID concurrently from two threads. The fix serializes the provider with a K_MUTEX_DEFINE(s_nonce_mutex) held for the duration of nonce generation.

Read more at https://www.tenable.com/cve/CVE-2026-15890

]]> https://www.tenable.com/cve/CVE-2026-94588 https://www.tenable.com/cve/CVE-2026-94588 Mon, 21 Sep 2026 21:17:22 GMT Medium Severity

Description

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Read more at https://www.tenable.com/cve/CVE-2026-94588

]]> https://www.tenable.com/cve/CVE-2026-94572 https://www.tenable.com/cve/CVE-2026-94572 Mon, 21 Sep 2026 21:17:22 GMT Critical Severity

Description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

Read more at https://www.tenable.com/cve/CVE-2026-94572

]]> https://www.tenable.com/cve/CVE-2026-94571 https://www.tenable.com/cve/CVE-2026-94571 Mon, 21 Sep 2026 21:17:21 GMT Critical Severity

Description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.

Read more at https://www.tenable.com/cve/CVE-2026-94571

]]> https://www.tenable.com/cve/CVE-2026-94424 https://www.tenable.com/cve/CVE-2026-94424 Mon, 21 Sep 2026 21:17:21 GMT Critical Severity

Description

A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94424

]]> https://www.tenable.com/cve/CVE-2026-93433 https://www.tenable.com/cve/CVE-2026-93433 Mon, 21 Sep 2026 21:17:17 GMT Medium Severity

Description

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.

Read more at https://www.tenable.com/cve/CVE-2026-93433

]]> https://www.tenable.com/cve/CVE-2026-88746 https://www.tenable.com/cve/CVE-2026-88746 Mon, 21 Sep 2026 21:17:15 GMT Medium Severity

Description

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

Read more at https://www.tenable.com/cve/CVE-2026-88746

]]> https://www.tenable.com/cve/CVE-2026-88745 https://www.tenable.com/cve/CVE-2026-88745 Mon, 21 Sep 2026 21:17:15 GMT Medium Severity

Description

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.

Read more at https://www.tenable.com/cve/CVE-2026-88745

]]> https://www.tenable.com/cve/CVE-2026-88467 https://www.tenable.com/cve/CVE-2026-88467 Mon, 21 Sep 2026 21:17:15 GMT High Severity

Description

CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.

Read more at https://www.tenable.com/cve/CVE-2026-88467

]]> https://www.tenable.com/cve/CVE-2026-88412 https://www.tenable.com/cve/CVE-2026-88412 Mon, 21 Sep 2026 21:17:15 GMT Medium Severity

Description

An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Read more at https://www.tenable.com/cve/CVE-2026-88412

]]> https://www.tenable.com/cve/CVE-2026-88411 https://www.tenable.com/cve/CVE-2026-88411 Mon, 21 Sep 2026 21:17:15 GMT High Severity

Description

Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.

Read more at https://www.tenable.com/cve/CVE-2026-88411

]]> https://www.tenable.com/cve/CVE-2026-88410 https://www.tenable.com/cve/CVE-2026-88410 Mon, 21 Sep 2026 21:17:15 GMT High Severity

Description

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

Read more at https://www.tenable.com/cve/CVE-2026-88410

]]> https://www.tenable.com/cve/CVE-2026-88409 https://www.tenable.com/cve/CVE-2026-88409 Mon, 21 Sep 2026 21:17:15 GMT High Severity

Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Read more at https://www.tenable.com/cve/CVE-2026-88409

]]> https://www.tenable.com/cve/CVE-2026-88408 https://www.tenable.com/cve/CVE-2026-88408 Mon, 21 Sep 2026 21:17:14 GMT Medium Severity

Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Read more at https://www.tenable.com/cve/CVE-2026-88408

]]> https://www.tenable.com/cve/CVE-2026-88407 https://www.tenable.com/cve/CVE-2026-88407 Mon, 21 Sep 2026 21:17:14 GMT High Severity

Description

An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Read more at https://www.tenable.com/cve/CVE-2026-88407

]]> https://www.tenable.com/cve/CVE-2026-88406 https://www.tenable.com/cve/CVE-2026-88406 Mon, 21 Sep 2026 21:17:14 GMT High Severity

Description

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

Read more at https://www.tenable.com/cve/CVE-2026-88406

]]> https://www.tenable.com/cve/CVE-2026-88405 https://www.tenable.com/cve/CVE-2026-88405 Mon, 21 Sep 2026 21:17:14 GMT Critical Severity

Description

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

Read more at https://www.tenable.com/cve/CVE-2026-88405

]]> https://www.tenable.com/cve/CVE-2026-88404 https://www.tenable.com/cve/CVE-2026-88404 Mon, 21 Sep 2026 21:17:14 GMT Critical Severity

Description

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload.

Read more at https://www.tenable.com/cve/CVE-2026-88404

]]> https://www.tenable.com/cve/CVE-2026-88403 https://www.tenable.com/cve/CVE-2026-88403 Mon, 21 Sep 2026 21:17:14 GMT Medium Severity

Description

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.

Read more at https://www.tenable.com/cve/CVE-2026-88403

]]> https://www.tenable.com/cve/CVE-2026-88402 https://www.tenable.com/cve/CVE-2026-88402 Mon, 21 Sep 2026 21:17:14 GMT High Severity

Description

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.

Read more at https://www.tenable.com/cve/CVE-2026-88402

]]> https://www.tenable.com/cve/CVE-2026-79919 https://www.tenable.com/cve/CVE-2026-79919 Mon, 21 Sep 2026 21:17:12 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym with RTLD_NEXT to resolve glibc's real syscall and bypass the sandbox syscall blacklist. An authenticated workspace member can consequently read or write files, execute processes, or access networks as the sandbox user. This issue is fixed in version 2.10.6-lts.

Read more at https://www.tenable.com/cve/CVE-2026-79919

]]> https://www.tenable.com/cve/CVE-2026-79918 https://www.tenable.com/cve/CVE-2026-79918 Mon, 21 Sep 2026 21:17:12 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subprocess creation but does not hook fexecve. An authenticated attacker able to execute tool code can call fexecve to start a process outside the sandbox's intended subprocess policy. This issue is fixed in version 2.10.6-lts.

Read more at https://www.tenable.com/cve/CVE-2026-79918

]]> https://www.tenable.com/cve/CVE-2026-79917 https://www.tenable.com/cve/CVE-2026-79917 Mon, 21 Sep 2026 21:17:12 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation exists but does not verify that it belongs to the authenticated chat_user_id or to the application bound to the caller's token. An attacker with any chat token and a known victim chat_id can create an unauthenticated public ChatShareLink exposing the victim's conversation and can create PublicFileAccess state that makes associated files retrievable without credentials, with no available revoke path. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-79917

]]> https://www.tenable.com/cve/CVE-2026-79916 https://www.tenable.com/cve/CVE-2026-79916 Mon, 21 Sep 2026 21:17:12 GMT Critical Severity

Description

MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials without safe parsing. An attacker can append a new AWS profile containing credential_process, then select that profile during a later model-validation request so botocore executes an attacker-controlled command as root. This vulnerability is fixed in 2.10.5-lts.

Read more at https://www.tenable.com/cve/CVE-2026-79916

]]> https://www.tenable.com/cve/CVE-2026-79317 https://www.tenable.com/cve/CVE-2026-79317 Mon, 21 Sep 2026 21:17:12 GMT Critical Severity

Description

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated.

Read more at https://www.tenable.com/cve/CVE-2026-79317

]]> https://www.tenable.com/cve/CVE-2026-79316 https://www.tenable.com/cve/CVE-2026-79316 Mon, 21 Sep 2026 21:17:12 GMT High Severity

Description

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.

Read more at https://www.tenable.com/cve/CVE-2026-79316

]]> https://www.tenable.com/cve/CVE-2026-77525 https://www.tenable.com/cve/CVE-2026-77525 Mon, 21 Sep 2026 21:17:11 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted non-debug record for a victim's published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use add_knowledge to copy victim answers while updating the victim record's improve_paragraph_id_list. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77525

]]> https://www.tenable.com/cve/CVE-2026-77523 https://www.tenable.com/cve/CVE-2026-77523 Mon, 21 Sep 2026 21:17:11 GMT High Severity

Description

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the query. An authenticated user with model read permission in an attacker-controlled workspace can supply a known victim model_id to read or overwrite the victim's model_params_form in another workspace, potentially altering workflows that use those defaults. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77523

]]> https://www.tenable.com/cve/CVE-2026-77522 https://www.tenable.com/cve/CVE-2026-77522 Mon, 21 Sep 2026 21:17:11 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77522

]]> https://www.tenable.com/cve/CVE-2026-77521 https://www.tenable.com/cve/CVE-2026-77521 Mon, 21 Sep 2026 21:17:10 GMT Critical Severity

Description

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on, so human approval is not required. Untrusted chat or ingested content can therefore cause command execution; source deployments with MAXKB_SANDBOX disabled run commands directly as the application user, while the official root container's string-based gosu wrapper allowed shell metacharacters to execute outside the intended sandbox. This issue is fixed in version 2.10.5-lts.

Read more at https://www.tenable.com/cve/CVE-2026-77521

]]> https://www.tenable.com/cve/CVE-2026-77520 https://www.tenable.com/cve/CVE-2026-77520 Mon, 21 Sep 2026 21:17:10 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range and the attacker knows or guesses its name, even though direct application detail and debug-open routes deny access. An attacker who can create and publish a workflow application can place the disclosed identifier in an attacker-owned workflow application-node, trigger that workflow, receive output generated by the victim application, and create durable application_chat and application_chat_record rows under the victim application because save and runtime paths do not verify permission to use the referenced application. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77520

]]> https://www.tenable.com/cve/CVE-2026-77519 https://www.tenable.com/cve/CVE-2026-77519 Mon, 21 Sep 2026 21:17:10 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77519

]]> https://www.tenable.com/cve/CVE-2026-77518 https://www.tenable.com/cve/CVE-2026-77518 Mon, 21 Sep 2026 21:17:10 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same workspace can retrieve the hidden tool through the tool-detail route because it does not apply the per-resource authorization used by the list route. The response includes Tool.code, which may contain MCP server configuration and headers, and an attacker who can create or edit an attacker-owned workflow can place the same foreign mcp_tool_id in a workflow mcp-node so workflow debug uses the owner's MCP configuration without verifying permission to use that tool. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77518

]]> https://www.tenable.com/cve/CVE-2026-77517 https://www.tenable.com/cve/CVE-2026-77517 Mon, 21 Sep 2026 21:17:10 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id without confirming that the object belongs to that knowledge base. A normal workspace user with a known victim document or paragraph UUID can use an attacker-owned knowledge-base path to read or modify content in another user's knowledge base. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77517

]]> https://www.tenable.com/cve/CVE-2026-77516 https://www.tenable.com/cve/CVE-2026-77516 Mon, 21 Sep 2026 21:17:10 GMT Medium Severity

Description

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it through the agent or workflow dispatch path. The dispatch path does not reapply the per-tool grant enforced by dedicated tool routes, and tool execution decrypts server-side init_params, allowing the caller to receive credentials carried by the denied tool. No fixed version is available as of this review.

Read more at https://www.tenable.com/cve/CVE-2026-77516

]]> https://www.tenable.com/cve/CVE-2026-73553 https://www.tenable.com/cve/CVE-2026-73553 Mon, 21 Sep 2026 21:17:09 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore_path_parameters_in_path_matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url_path matcher evaluates the raw path. A downstream request such as /admin;x can therefore miss a DENY rule for /admin while the router still selects the protected /admin backend. The inconsistent canonicalization allows an unauthenticated client to bypass path-based authorization. The relevant scope boundary is that the route option and a path-based RBAC rule must both be present, and the protected route must match after stripping. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73553

]]> https://www.tenable.com/cve/CVE-2026-73551 https://www.tenable.com/cve/CVE-2026-73551 Mon, 21 Sep 2026 21:17:09 GMT Medium Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73551

]]> https://www.tenable.com/cve/CVE-2026-73511 https://www.tenable.com/cve/CVE-2026-73511 Mon, 21 Sep 2026 21:17:09 GMT Medium Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73511

]]> https://www.tenable.com/cve/CVE-2026-67827 https://www.tenable.com/cve/CVE-2026-67827 Mon, 21 Sep 2026 21:17:08 GMT Critical Severity

Description

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.

Read more at https://www.tenable.com/cve/CVE-2026-67827

]]> https://www.tenable.com/cve/CVE-2026-61647 https://www.tenable.com/cve/CVE-2026-61647 Mon, 21 Sep 2026 21:17:07 GMT High Severity

Description

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.

Read more at https://www.tenable.com/cve/CVE-2026-61647

]]> https://www.tenable.com/cve/CVE-2026-59816 https://www.tenable.com/cve/CVE-2026-59816 Mon, 21 Sep 2026 21:17:06 GMT Medium Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBE_ENABLED=true pass the decoded id directly into transcription backend URLs. An authenticated user can place URL-encoded slash and parent-directory segments in the job ID, causing parseSubPath() to decode a path that escapes the intended /transcribe/ prefix. The server then proxies the request to other transcription-backend endpoints and can return their responses, potentially exposing internal administrative, health, or configuration data. This issue is fixed in version 3.7.7.

Read more at https://www.tenable.com/cve/CVE-2026-59816

]]> https://www.tenable.com/cve/CVE-2026-58272 https://www.tenable.com/cve/CVE-2026-58272 Mon, 21 Sep 2026 21:17:06 GMT Medium Severity

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.

Read more at https://www.tenable.com/cve/CVE-2026-58272

]]> https://www.tenable.com/cve/CVE-2026-58270 https://www.tenable.com/cve/CVE-2026-58270 Mon, 21 Sep 2026 21:17:06 GMT Medium Severity

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, the sync diff endpoint compiles a user-supplied string into a `RegExp` with no complexity validation. A catastrophic-backtracking pattern (e.g. `^(a+)+b`) blocks the Node.js event loop, making the entire server unresponsive to all users until the container is restarted. Version 2.4.0 patches the issue.

Read more at https://www.tenable.com/cve/CVE-2026-58270

]]> https://www.tenable.com/cve/CVE-2026-55179 https://www.tenable.com/cve/CVE-2026-55179 Mon, 21 Sep 2026 21:17:05 GMT Medium Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking whether the signed-in user owns or can access that item. Any authenticated user who obtains or guesses another user's item ID can read the corresponding note or item content when end-to-end encryption does not protect it. This issue is fixed in version 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-55179

]]> https://www.tenable.com/cve/CVE-2026-55105 https://www.tenable.com/cve/CVE-2026-55105 Mon, 21 Sep 2026 21:17:05 GMT High Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain code block can therefore execute script when Fountain rendering is enabled in desktop or mobile clients, or when a note is published through Joplin Server where Fountain rendering is enabled by default. The script can read content subsequently loaded in the reused note viewer or, when published notes are served from the same domain as server content, access data available to an authenticated browser in the server origin. This issue is fixed in versions 3.6.15 and 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-55105

]]> https://www.tenable.com/cve/CVE-2026-49453 https://www.tenable.com/cve/CVE-2026-49453 Mon, 21 Sep 2026 21:17:03 GMT High Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-49453

]]> https://www.tenable.com/cve/CVE-2026-49450 https://www.tenable.com/cve/CVE-2026-49450 Mon, 21 Sep 2026 21:17:03 GMT High Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-49450

]]> https://www.tenable.com/cve/CVE-2026-49449 https://www.tenable.com/cve/CVE-2026-49449 Mon, 21 Sep 2026 21:17:03 GMT Low Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/rules/katex.ts enables KaTeX's trust option for note content, allowing a note author to place a \href URL into rendered output without passing Joplin's normal URL allowlist. On Windows, clicking a link whose target is an attacker-controlled UNC path causes pathExists() to initiate SMB authentication and disclose the current user's NTLMv2 challenge-response without a warning. The unfiltered URL can also invoke other registered URL handlers, but the credential disclosure through KaTeX \href is the distinguishing demonstrated impact. This issue is fixed in version 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-49449

]]> https://www.tenable.com/cve/CVE-2026-46649 https://www.tenable.com/cve/CVE-2026-46649 Mon, 21 Sep 2026 21:17:03 GMT Critical Severity

Description

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /api/login_with_code/:id endpoint accepts a nine-digit SSO authentication code with a ten-minute lifetime without applying limiterLoginBruteForce. An unauthenticated attacker who targets a user during an active SSO login can make unlimited guesses, and a correct code returns a full session token that permits access to and modification of the user's notes, notebooks, and account settings. This issue is fixed in version 3.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-46649

]]> https://www.tenable.com/cve/CVE-2026-85219 https://www.tenable.com/cve/CVE-2026-85219 Mon, 21 Sep 2026 20:17:36 GMT Low Severity

Description

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.

Read more at https://www.tenable.com/cve/CVE-2026-85219

]]> https://www.tenable.com/cve/CVE-2026-81469 https://www.tenable.com/cve/CVE-2026-81469 Mon, 21 Sep 2026 20:17:33 GMT High Severity

Description

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges

Read more at https://www.tenable.com/cve/CVE-2026-81469

]]> https://www.tenable.com/cve/CVE-2026-79320 https://www.tenable.com/cve/CVE-2026-79320 Mon, 21 Sep 2026 20:17:32 GMT Medium Severity

Description

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin.

Read more at https://www.tenable.com/cve/CVE-2026-79320

]]> https://www.tenable.com/cve/CVE-2026-79319 https://www.tenable.com/cve/CVE-2026-79319 Mon, 21 Sep 2026 20:17:32 GMT Critical Severity

Description

Stencil core 4.43.5 is vulnerable to Incorrect Access Control.

Read more at https://www.tenable.com/cve/CVE-2026-79319

]]> https://www.tenable.com/cve/CVE-2026-79318 https://www.tenable.com/cve/CVE-2026-79318 Mon, 21 Sep 2026 20:17:32 GMT High Severity

Description

web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).

Read more at https://www.tenable.com/cve/CVE-2026-79318

]]> https://www.tenable.com/cve/CVE-2026-73552 https://www.tenable.com/cve/CVE-2026-73552 Mon, 21 Sep 2026 20:17:28 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy HTTP RBAC accepts RFC-valid opaque header bytes but evaluates safe_regex values with RE2's UTF-8 subject semantics. A downstream client can preserve a prohibited marker and add an unrelated obs-text octet, causing RE2::FullMatch to return false and a negative RBAC policy to treat the invalid subject as an ordinary no-match. A byte-oriented route matcher can still observe the marker, allowing the request to reach a route intended to be denied. The relevant scope boundary is that plain positive ALLOW regexes normally fail closed, and exact, prefix, suffix, and contains matchers are not shown to have this subject-domain failure. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73552

]]> https://www.tenable.com/cve/CVE-2026-73550 https://www.tenable.com/cve/CVE-2026-73550 Mon, 21 Sep 2026 20:17:28 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes and count are not charged against request header limits. An unauthenticated client can use HPACK indexing to submit many references to a large Host value across a bounded number of streams, forcing extreme header-copy allocation and causing the proxy to be out-of-memory killed. The relevant scope boundary is that the demonstrated amplification uses HTTP/2 HPACK and the duplicate Host discard behavior. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73550

]]> https://www.tenable.com/cve/CVE-2026-73549 https://www.tenable.com/cve/CVE-2026-73549 Mon, 21 Sep 2026 20:17:28 GMT Medium Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73549

]]> https://www.tenable.com/cve/CVE-2026-73548 https://www.tenable.com/cve/CVE-2026-73548 Mon, 21 Sep 2026 20:17:28 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73548

]]> https://www.tenable.com/cve/CVE-2026-73547 https://www.tenable.com/cve/CVE-2026-73547 Mon, 21 Sep 2026 20:17:28 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ext_authz filter assumes that a request contains a :path pseudoheader when applying query_parameters_to_set or query_parameters_to_remove from an authorization response. A path-less CONNECT request makes request_headers_->Path() return null, and Filter::onComplete dereferences that pointer while parsing the query string. An unauthenticated downstream client can crash the Envoy process when the filter and authorization response use query-parameter mutation. The relevant scope boundary is that the deployment must accept path-less CONNECT and configure ext_authz query-parameter mutation. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73547

]]> https://www.tenable.com/cve/CVE-2026-73546 https://www.tenable.com/cve/CVE-2026-73546 Mon, 21 Sep 2026 20:17:28 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73546

]]> https://www.tenable.com/cve/CVE-2026-73513 https://www.tenable.com/cve/CVE-2026-73513 Mon, 21 Sep 2026 20:17:27 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's optional oghttp2 upstream HTTP/2 codec accepts a response trailer HEADERS frame without END_STREAM. Envoy completes and deferred-deletes the ActiveRequest while oghttp2 keeps the stream open, leaving ClientStreamImpl with a dangling response_decoder_ reference. A later frame on the stream can dispatch through the freed object and crash the process. The relevant scope boundary is that the default nghttp2 codec rejects the malformed trailers, and the trigger is upstream-only with oghttp2 enabled. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73513

]]> https://www.tenable.com/cve/CVE-2026-73512 https://www.tenable.com/cve/CVE-2026-73512 Mon, 21 Sep 2026 20:17:27 GMT High Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HttpDatagramHandler caches the current RequestDecoder when Capsule Protocol is enabled. Stream recreation, including an internal redirect, replaces the ActiveStream and updates EnvoyQuicServerStream but does not update the handler's cached pointer. A subsequent HTTP/3 datagram can call decodeData through the freed decoder, causing invalid virtual dispatch and a process crash. The relevant scope boundary is that hTTP/3 datagrams and Capsule Protocol must be enabled, and the request must enter a stream-recreation path such as an internal redirect. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-73512

]]> https://www.tenable.com/cve/CVE-2026-62247 https://www.tenable.com/cve/CVE-2026-62247 Mon, 21 Sep 2026 20:17:27 GMT Medium Severity

Description

Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.2, Realtime authorization does not correctly honor the per-extension presence.read row-level security policy when a private-channel client is allowed presence.write but explicitly denied presence.read. Under that differential policy, the client can receive presence_diff messages containing other members' presence metadata, including application-defined location, online-status, roster, viewing, or typing information. Deployments with uniform presence visibility have no differential, and postgres_changes row data is unaffected. This issue is fixed in version 2.111.2.

Read more at https://www.tenable.com/cve/CVE-2026-62247

]]> https://www.tenable.com/cve/CVE-2026-58271 https://www.tenable.com/cve/CVE-2026-58271 Mon, 21 Sep 2026 20:17:26 GMT Medium Severity

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync/register` accepts credentials and a TOTP code to register a desktop sync client. On a failed TOTP, `SyncClientsManager.register()` calls `updateAccesses(user, ip, false)`, which hits a freeze branch that writes `passwordAttempts` back unchanged. The counter never reaches `USER_MAX_PASSWORD_ATTEMPTS` (10) and the lockout gate never fires. A successful guess returns a `{clientId, clientToken}` pair. The token can be exchanged via `POST /api/app/sync/auth/cookie` for a full JWT. While the code is valid, the attacker can also call `POST /api/auth/2fa/disable` to permanently remove MFA. Version 2.4.0 patches the issue.

Read more at https://www.tenable.com/cve/CVE-2026-58271

]]> https://www.tenable.com/cve/CVE-2026-58269 https://www.tenable.com/cve/CVE-2026-58269 Mon, 21 Sep 2026 20:17:26 GMT High Severity

Description

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request. The parallel login endpoint (`POST /api/auth/login`) correctly enforces 2FA by calling `setCookies(user, res, true)`, which gates on `user.twoFaEnabled`. Version 2.4.0 patches the issue.

Read more at https://www.tenable.com/cve/CVE-2026-58269

]]> https://www.tenable.com/cve/CVE-2026-55897 https://www.tenable.com/cve/CVE-2026-55897 Mon, 21 Sep 2026 20:17:26 GMT High Severity

Description

luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.

Read more at https://www.tenable.com/cve/CVE-2026-55897

]]> https://www.tenable.com/cve/CVE-2026-55159 https://www.tenable.com/cve/CVE-2026-55159 Mon, 21 Sep 2026 20:17:26 GMT High Severity

Description

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.

Read more at https://www.tenable.com/cve/CVE-2026-55159

]]> https://www.tenable.com/cve/CVE-2026-54915 https://www.tenable.com/cve/CVE-2026-54915 Mon, 21 Sep 2026 20:17:26 GMT Medium Severity

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but leaves tab, line-feed, and carriage-return characters intact. With the default root HTTP_ROOT configuration, CherryPy HTTPRedirect passes the resulting value to urllib.parse.urljoin, which can resolve the whitespace-bearing path to an attacker-controlled external origin. A user who follows a crafted link can therefore be redirected outside Tautulli for phishing or post-login redirect-flow abuse, while custom non-root HTTP_ROOT configurations are not affected by this bypass. This issue is fixed in version 2.17.2.

Read more at https://www.tenable.com/cve/CVE-2026-54915

]]> https://www.tenable.com/cve/CVE-2026-52835 https://www.tenable.com/cve/CVE-2026-52835 Mon, 21 Sep 2026 20:17:26 GMT High Severity

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.filename or database_file.filename directly to CACHE_DIR without basename reduction or a containment check. An administrator or caller with the instance API key can submit a multipart filename containing parent-directory segments, causing the upload to be created or overwritten outside CACHE_DIR before file-content validation runs. The write is limited to paths permitted to the Tautulli process, but it can enable configuration tampering, service disruption, or code execution. This issue is fixed in version 2.17.2.

Read more at https://www.tenable.com/cve/CVE-2026-52835

]]> https://www.tenable.com/cve/CVE-2026-50572 https://www.tenable.com/cve/CVE-2026-50572 Mon, 21 Sep 2026 20:17:25 GMT Medium Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-50572

]]> https://www.tenable.com/cve/CVE-2026-49995 https://www.tenable.com/cve/CVE-2026-49995 Mon, 21 Sep 2026 20:17:25 GMT Medium Severity

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.

Read more at https://www.tenable.com/cve/CVE-2026-49995

]]> https://www.tenable.com/cve/CVE-2026-49811 https://www.tenable.com/cve/CVE-2026-49811 Mon, 21 Sep 2026 20:17:25 GMT High Severity

Description

Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Read more at https://www.tenable.com/cve/CVE-2026-49811

]]> https://www.tenable.com/cve/CVE-2026-48521 https://www.tenable.com/cve/CVE-2026-48521 Mon, 21 Sep 2026 20:17:25 GMT Medium Severity

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Read more at https://www.tenable.com/cve/CVE-2026-48521

]]> https://www.tenable.com/cve/CVE-2026-45381 https://www.tenable.com/cve/CVE-2026-45381 Mon, 21 Sep 2026 20:17:25 GMT Medium Severity

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashes. A backslash-quote sequence can terminate the string, so an unauthenticated attacker can send a crafted link that executes script in the Tautulli web context when an authenticated user follows it. This issue is fixed in version 2.17.2.

Read more at https://www.tenable.com/cve/CVE-2026-45381

]]> https://www.tenable.com/cve/CVE-2026-94501 https://www.tenable.com/cve/CVE-2026-94501 Mon, 21 Sep 2026 19:17:21 GMT High Severity

Description

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tenant.

Read more at https://www.tenable.com/cve/CVE-2026-94501

]]> https://www.tenable.com/cve/CVE-2026-94497 https://www.tenable.com/cve/CVE-2026-94497 Mon, 21 Sep 2026 19:17:21 GMT High Severity

Description

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

Read more at https://www.tenable.com/cve/CVE-2026-94497

]]> https://www.tenable.com/cve/CVE-2026-94496 https://www.tenable.com/cve/CVE-2026-94496 Mon, 21 Sep 2026 19:17:21 GMT High Severity

Description

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

Read more at https://www.tenable.com/cve/CVE-2026-94496

]]> https://www.tenable.com/cve/CVE-2026-94495 https://www.tenable.com/cve/CVE-2026-94495 Mon, 21 Sep 2026 19:17:21 GMT High Severity

Description

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

Read more at https://www.tenable.com/cve/CVE-2026-94495

]]> https://www.tenable.com/cve/CVE-2026-94494 https://www.tenable.com/cve/CVE-2026-94494 Mon, 21 Sep 2026 19:17:20 GMT Medium Severity

Description

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

Read more at https://www.tenable.com/cve/CVE-2026-94494

]]> https://www.tenable.com/cve/CVE-2026-94414 https://www.tenable.com/cve/CVE-2026-94414 Mon, 21 Sep 2026 19:17:20 GMT Medium Severity

Description

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.

Read more at https://www.tenable.com/cve/CVE-2026-94414

]]> https://www.tenable.com/cve/CVE-2026-94413 https://www.tenable.com/cve/CVE-2026-94413 Mon, 21 Sep 2026 19:17:20 GMT High Severity

Description

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.

Read more at https://www.tenable.com/cve/CVE-2026-94413

]]> https://www.tenable.com/cve/CVE-2026-94412 https://www.tenable.com/cve/CVE-2026-94412 Mon, 21 Sep 2026 19:17:20 GMT High Severity

Description

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's password. Attackers can submit a request with an arbitrary target user ID to reset that account's password to a known default value, enabling unauthorized access to other user accounts including administrators.

Read more at https://www.tenable.com/cve/CVE-2026-94412

]]> https://www.tenable.com/cve/CVE-2026-94411 https://www.tenable.com/cve/CVE-2026-94411 Mon, 21 Sep 2026 19:17:20 GMT High Severity

Description

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbitrary roles. Attackers can send a POST request with type=UserRole, their own user ID, and a role ID list to escalate from low-privilege tenant user to tenant administrator.

Read more at https://www.tenable.com/cve/CVE-2026-94411

]]> https://www.tenable.com/cve/CVE-2026-94403 https://www.tenable.com/cve/CVE-2026-94403 Mon, 21 Sep 2026 19:17:19 GMT Critical Severity

Description

A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94403

]]> https://www.tenable.com/cve/CVE-2026-91167 https://www.tenable.com/cve/CVE-2026-91167 Mon, 21 Sep 2026 19:17:15 GMT Medium Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.rs through AdminContext but does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant. The endpoint cannot create a role assignment that never existed because it returns not found without a matching user and role pair. This issue is fixed in version 0.28.4.

Read more at https://www.tenable.com/cve/CVE-2026-91167

]]> https://www.tenable.com/cve/CVE-2026-91166 https://www.tenable.com/cve/CVE-2026-91166 Mon, 21 Sep 2026 19:17:15 GMT Medium Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes ssh_options.host and ssh_options.port for the final target to KnownHosts::trust. In Prompt and AutoAccept modes, a jump host key can therefore be stored for the target address. A machine later presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

Read more at https://www.tenable.com/cve/CVE-2026-91166

]]> https://www.tenable.com/cve/CVE-2026-91165 https://www.tenable.com/cve/CVE-2026-91165 Mon, 21 Sep 2026 19:17:15 GMT Low Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_json::to_string inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The vulnerable value can enter the script block through the attacker-controlled next redirect parameter stored by warpgate-protocol-http/src/api/sso_provider_detail.rs or through IdP-derived error messages that make_redirect_url concatenates without URL encoding. The IdP-derived path is reachable when the attacker controls a configured identity provider, or when the attacker controls the email or username claim on an attacker-controlled account and the configured identity provider permits the required unvalidated claim format. A victim must complete the form_post SSO flow for the injected markup to be rendered. The Warpgate Content-Security-Policy blocks injected JavaScript and event handlers, so the demonstrated impact is content spoofing, a false login form, or a meta refresh rather than script execution. This issue is fixed in version 0.27.6.

Read more at https://www.tenable.com/cve/CVE-2026-91165

]]> https://www.tenable.com/cve/CVE-2026-91164 https://www.tenable.com/cve/CVE-2026-91164 Mon, 21 Sep 2026 19:17:14 GMT Medium Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::UserToken without enforcing the owning user's allowed_ip_ranges against the trusted client address in warpgate-protocol-http/src/common.rs. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can therefore use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and HTTP target proxying plus SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

Read more at https://www.tenable.com/cve/CVE-2026-91164

]]> https://www.tenable.com/cve/CVE-2026-82165 https://www.tenable.com/cve/CVE-2026-82165 Mon, 21 Sep 2026 19:17:12 GMT Medium Severity

Description

Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Read more at https://www.tenable.com/cve/CVE-2026-82165

]]> https://www.tenable.com/cve/CVE-2026-82163 https://www.tenable.com/cve/CVE-2026-82163 Mon, 21 Sep 2026 19:17:11 GMT Medium Severity

Description

Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Read more at https://www.tenable.com/cve/CVE-2026-82163

]]> https://www.tenable.com/cve/CVE-2026-66280 https://www.tenable.com/cve/CVE-2026-66280 Mon, 21 Sep 2026 19:17:08 GMT Severity Not Scored

Description

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Read more at https://www.tenable.com/cve/CVE-2026-66280

]]> https://www.tenable.com/cve/CVE-2026-63330 https://www.tenable.com/cve/CVE-2026-63330 Mon, 21 Sep 2026 19:17:08 GMT High Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recordings/{uuid}/stream only with session authentication and omits require_admin_permission for AdminPermission::RecordingsView. Any authenticated regular user who identifies an active recording can subscribe to its WebSocket and receive real-time terminal input and output from proxied SSH, MySQL, or PostgreSQL sessions, including credentials, commands, and other sensitive data belonging to users and administrators. This issue is fixed in version 0.25.6.

Read more at https://www.tenable.com/cve/CVE-2026-63330

]]> https://www.tenable.com/cve/CVE-2026-63329 https://www.tenable.com/cve/CVE-2026-63329 Mon, 21 Sep 2026 19:17:08 GMT Medium Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before inject_own_headers appends the authenticated username. Because the request builder preserves repeated values, a proxied backend that trusts the first x-warpgate-username value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header, and warpgate-common/src/http_headers.rs does not exclude either reserved identity header. This issue is fixed in version 0.25.6.

Read more at https://www.tenable.com/cve/CVE-2026-63329

]]> https://www.tenable.com/cve/CVE-2026-61749 https://www.tenable.com/cve/CVE-2026-61749 Mon, 21 Sep 2026 19:17:07 GMT Medium Severity

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.

Read more at https://www.tenable.com/cve/CVE-2026-61749

]]> https://www.tenable.com/cve/CVE-2026-61748 https://www.tenable.com/cve/CVE-2026-61748 Mon, 21 Sep 2026 19:17:07 GMT Medium Severity

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.

Read more at https://www.tenable.com/cve/CVE-2026-61748

]]> https://www.tenable.com/cve/CVE-2026-61747 https://www.tenable.com/cve/CVE-2026-61747 Mon, 21 Sep 2026 19:17:07 GMT Medium Severity

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.

Read more at https://www.tenable.com/cve/CVE-2026-61747

]]> https://www.tenable.com/cve/CVE-2026-61746 https://www.tenable.com/cve/CVE-2026-61746 Mon, 21 Sep 2026 19:17:07 GMT Medium Severity

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

Read more at https://www.tenable.com/cve/CVE-2026-61746

]]> https://www.tenable.com/cve/CVE-2026-61744 https://www.tenable.com/cve/CVE-2026-61744 Mon, 21 Sep 2026 19:17:07 GMT Medium Severity

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.

Read more at https://www.tenable.com/cve/CVE-2026-61744

]]> https://www.tenable.com/cve/CVE-2026-58491 https://www.tenable.com/cve/CVE-2026-58491 Mon, 21 Sep 2026 19:17:06 GMT Critical Severity

Description

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes SSO can cause markup and JavaScript to execute in the authenticated Warpgate origin, allowing access to session data and actions through user APIs, and through administrator APIs only when the victim is an administrator. The GET /@warpgate/api/sso/return path also uses the same unvalidated value as a redirect destination, enabling an open redirect. This issue is fixed in version 0.25.5.

Read more at https://www.tenable.com/cve/CVE-2026-58491

]]> https://www.tenable.com/cve/CVE-2026-49810 https://www.tenable.com/cve/CVE-2026-49810 Mon, 21 Sep 2026 19:17:06 GMT High Severity

Description

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Read more at https://www.tenable.com/cve/CVE-2026-49810

]]> https://www.tenable.com/cve/CVE-2026-17052 https://www.tenable.com/cve/CVE-2026-17052 Mon, 21 Sep 2026 19:17:04 GMT High Severity

Description

The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded. tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller. The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call. Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header () and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.

Read more at https://www.tenable.com/cve/CVE-2026-17052

]]> https://www.tenable.com/cve/CVE-2026-94488 https://www.tenable.com/cve/CVE-2026-94488 Mon, 21 Sep 2026 18:17:17 GMT High Severity

Description

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were forwarded into a group by a member (it is not necessary for the message author to be a member of a group).

Read more at https://www.tenable.com/cve/CVE-2026-94488

]]> https://www.tenable.com/cve/CVE-2026-93012 https://www.tenable.com/cve/CVE-2026-93012 Mon, 21 Sep 2026 18:17:16 GMT Critical Severity

Description

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open() passes to a shell. Every other platform gets the list form, which runs sendmail directly. When the caller supplies no envelope, Email::Sender::Simple takes the recipients from the To and Cc headers and the sender from the From header. An attacker who controls one of those header addresses runs commands as the sending process.

Read more at https://www.tenable.com/cve/CVE-2026-93012

]]> https://www.tenable.com/cve/CVE-2026-92382 https://www.tenable.com/cve/CVE-2026-92382 Mon, 21 Sep 2026 18:17:14 GMT Medium Severity

Description

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Read more at https://www.tenable.com/cve/CVE-2026-92382

]]> https://www.tenable.com/cve/CVE-2026-69190 https://www.tenable.com/cve/CVE-2026-69190 Mon, 21 Sep 2026 18:17:10 GMT Medium Severity

Description

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.

Read more at https://www.tenable.com/cve/CVE-2026-69190

]]> https://www.tenable.com/cve/CVE-2026-62369 https://www.tenable.com/cve/CVE-2026-62369 Mon, 21 Sep 2026 18:17:09 GMT High Severity

Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destination without sufficient validation. During keadm join or installation on Windows edge nodes, an archive influenced through a compromised, replaced, or untrusted download source can contain parent-directory components, Windows-style backslashes, absolute paths, or drive-prefixed paths that escape the intended directory. The affected keadm process can consequently write or overwrite files with its own privileges, potentially modifying configuration, executable, or service files and enabling persistent system modification or code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Read more at https://www.tenable.com/cve/CVE-2026-62369

]]> https://www.tenable.com/cve/CVE-2026-62182 https://www.tenable.com/cve/CVE-2026-62182 Mon, 21 Sep 2026 18:17:09 GMT High Severity

Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 until 1.21.2, 1.22.2, and 1.23.1, ConfigUpdateJob processing in edge/pkg/taskmanager/actions/configupdatejob.go concatenates authenticated user-controlled updateFields values into the keadm config-update command and executes it through a system shell. A user with permission to create or modify ConfigUpdateJob resources can include shell metacharacters in the complete --set value and cause arbitrary commands to execute on an enrolled target edge node with the privileges of the KubeEdge process handling the job. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Read more at https://www.tenable.com/cve/CVE-2026-62182

]]> https://www.tenable.com/cve/CVE-2026-61745 https://www.tenable.com/cve/CVE-2026-61745 Mon, 21 Sep 2026 18:17:09 GMT Medium Severity

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.

Read more at https://www.tenable.com/cve/CVE-2026-61745

]]> https://www.tenable.com/cve/CVE-2026-61612 https://www.tenable.com/cve/CVE-2026-61612 Mon, 21 Sep 2026 18:17:09 GMT Medium Severity

Description

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied `server_url` whose hostname *resolves* to an internal address passes the guard, so the server issues requests to loopback and cloud metadata (`169.254.169.254`). This is a third bypass of the same guard, and it reaches IMDS — strictly more than CVE-2026-53509, which only reached loopback. Version 0.4.108 contains an updated fix.

Read more at https://www.tenable.com/cve/CVE-2026-61612

]]> https://www.tenable.com/cve/CVE-2026-55473 https://www.tenable.com/cve/CVE-2026-55473 Mon, 21 Sep 2026 18:17:08 GMT Medium Severity

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifier_url.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test, and on a Homebox instance that egresses through NAT64/DNS64, the gateway can translate an accepted IPv6 destination to cloud metadata, localhost, or another internal IPv4 host. The notifier test path returns delivery result information, and Shoutrrr propagates the response, providing feedback that can disclose retrieved metadata such as temporary credentials. Without NAT64 egress, the crafted IPv6 destination is not routable, but the guard still incorrectly classifies it as safe. This issue is fixed in version 0.26.0.

Read more at https://www.tenable.com/cve/CVE-2026-55473

]]> https://www.tenable.com/cve/CVE-2026-48976 https://www.tenable.com/cve/CVE-2026-48976 Mon, 21 Sep 2026 18:17:08 GMT High Severity

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another tenant's notifier UUID to PUT /v1/notifiers/{id} can read the returned stored url, which may contain plaintext Shoutrrr credentials for Slack, SMTP, Telegram, Pushover, or Discord, and can replace the URL to redirect the victim's notifications to an attacker-controlled webhook. This issue is fixed in version 0.26.0.

Read more at https://www.tenable.com/cve/CVE-2026-48976

]]> https://www.tenable.com/cve/CVE-2026-48975 https://www.tenable.com/cve/CVE-2026-48975 Mon, 21 Sep 2026 18:17:08 GMT High Severity

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that the maintenance entry belongs to the authenticated user's active group. An authenticated low-privileged user who knows or enumerates another tenant's maintenance-entry UUID can overwrite that record or permanently delete it. This issue is fixed in version 0.26.0.

Read more at https://www.tenable.com/cve/CVE-2026-48975

]]> https://www.tenable.com/cve/CVE-2026-48974 https://www.tenable.com/cve/CVE-2026-48974 Mon, 21 Sep 2026 18:17:08 GMT Medium Severity

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a caller-supplied userID without requiring an owner role, an invitation token, target-user consent, or target-user notification. Any authenticated user can force another account into the caller's group, disclose the target user's email address and name through the resulting member list, and create the membership prerequisite used by a separate cross-group inventory-wipe vulnerability. This issue is fixed in version 0.26.0.

Read more at https://www.tenable.com/cve/CVE-2026-48974

]]> https://www.tenable.com/cve/CVE-2026-48826 https://www.tenable.com/cve/CVE-2026-48826 Mon, 21 Sep 2026 18:17:08 GMT High Severity

Description

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the active group, while the active group is selected through the X-Tenant request header. Because every self-registered user who creates a group receives the global owner value, a user who is also a member of another group can select that group with X-Tenant and permanently delete its complete inventory, which is not recoverable without external backups. This issue is fixed in version 0.26.0.

Read more at https://www.tenable.com/cve/CVE-2026-48826

]]> https://www.tenable.com/cve/CVE-2026-94449 https://www.tenable.com/cve/CVE-2026-94449 Mon, 21 Sep 2026 17:19:20 GMT High Severity

Description

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the ApplyGuard or ApplyFaultTolerance annotations, where the library fails to release internal tracking objects after each request. This causes a steady increase in memory usage that eventually leads to the application slowing down and crashing due to lack of memory.

Read more at https://www.tenable.com/cve/CVE-2026-94449

]]> https://www.tenable.com/cve/CVE-2026-84990 https://www.tenable.com/cve/CVE-2026-84990 Mon, 21 Sep 2026 17:19:13 GMT High Severity

Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and scripts/lua/rest/v2/get/system/configurations/download_backup.lua allow any authenticated non-admin user to list and download system-configuration backups without an administrator check. The download path reaches backup_config.export_backup, and prefs_dump_utils.build_prefs_dump_table includes the ntopng.user.* Redis key space in the backup. A downloaded backup can therefore disclose password hashes for local users and, when configured, API tokens, TOTP secrets, and WebAuthn credential data, enabling account compromise through usable or recoverable credentials. This issue is fixed in version 6.7.260718.

Read more at https://www.tenable.com/cve/CVE-2026-84990

]]> https://www.tenable.com/cve/CVE-2026-83621 https://www.tenable.com/cve/CVE-2026-83621 Mon, 21 Sep 2026 17:19:08 GMT High Severity

Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit/system/edit_blacklist.lua lacks an administrator check and calls lists_utils.editList for any authenticated user. The list_name, list_enabled, url, and list_update parameters allow a non-admin user to redirect threat-intelligence downloads to attacker-controlled content, disable blocklists, or prevent scheduled updates. The changes are persisted through Redis and reloaded without a lower-level authorization guard, undermining the integrity and availability of ntopng's threat-intelligence monitoring. This issue is fixed in version 6.7.260717.

Read more at https://www.tenable.com/cve/CVE-2026-83621

]]> https://www.tenable.com/cve/CVE-2026-79920 https://www.tenable.com/cve/CVE-2026-79920 Mon, 21 Sep 2026 17:18:59 GMT Critical Severity

Description

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.

Read more at https://www.tenable.com/cve/CVE-2026-79920

]]> https://www.tenable.com/cve/CVE-2026-77582 https://www.tenable.com/cve/CVE-2026-77582 Mon, 21 Sep 2026 17:18:53 GMT Medium Severity

Description

Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely observable timing difference between authentication attempts for existing and nonexistent local usernames. internal/controller/user_controller.go loginHandler and internal/middleware/context_middleware.go basicAuth return quickly after internal/service/auth_service.go reports a missing user, while an existing user causes bcrypt password verification work. Repeated measurements can therefore disclose valid usernames and support targeted credential attacks. This issue is fixed in version 5.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-77582

]]> https://www.tenable.com/cve/CVE-2026-77561 https://www.tenable.com/cve/CVE-2026-77561 Mon, 21 Sep 2026 17:18:52 GMT Medium Severity

Description

Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-77561

]]> https://www.tenable.com/cve/CVE-2026-77560 https://www.tenable.com/cve/CVE-2026-77560 Mon, 21 Sep 2026 17:18:52 GMT High Severity

Description

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensitively while reverse proxies route equivalent hostnames case-insensitively, allowing an authenticated low-privilege user to bypass per-app access controls with a differently cased hostname. The lookup in internal/service/access_controls_service.go through lookupStaticACLs and GetAccessControls, and the Docker-label fallback in internal/service/docker_service.go through GetLabels, can miss the configured app and return an empty access-control object. internal/controller/proxy_controller.go proxyHandler then treats the empty user, group, OAuth, LDAP, and IP restrictions as permissive and returns an authenticated result for an app that should exclude the user. Unauthenticated users remain subject to login, and global login-time allowlists are not bypassed. This issue is fixed in version 5.1.2.

Read more at https://www.tenable.com/cve/CVE-2026-77560

]]> https://www.tenable.com/cve/CVE-2026-76898 https://www.tenable.com/cve/CVE-2026-76898 Mon, 21 Sep 2026 17:18:50 GMT High Severity

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8.

Read more at https://www.tenable.com/cve/CVE-2026-76898

]]> https://www.tenable.com/cve/CVE-2026-63416 https://www.tenable.com/cve/CVE-2026-63416 Mon, 21 Sep 2026 17:17:39 GMT Low Severity

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath and appends it directly to EXPORT_URL without rejecting dot segments or confirming that the normalized destination remains under the configured export path. An unauthenticated request containing traversal segments can therefore address unintended routes on the internal export server, and the servlet forwards all request headers and the request body to that destination, allowing arbitrary header injection. Depending on the export service configuration, exploitation can expose administration, debugging, health, or configuration endpoints and can permit unintended internal actions. This issue is fixed in version 30.2.7.

Read more at https://www.tenable.com/cve/CVE-2026-63416

]]> https://www.tenable.com/cve/CVE-2026-63373 https://www.tenable.com/cve/CVE-2026-63373 Mon, 21 Sep 2026 17:17:39 GMT Medium Severity

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever IS_GAE is false, which affects self-hosted Docker and WAR deployments. An attacker can provide an authorization code for the attacker's cloud-storage identity and induce a victim to visit a callback URL, causing the victim's draw.io session to become authenticated as the attacker identity without a valid state binding. The shared handler affects Google Drive, OneDrive, GitHub, GitLab, and Dropbox integrations. The victim can then unknowingly perform cloud-storage actions under the attacker's identity, causing session integrity loss and misattribution, but the identity binding does not itself grant access to existing victim cloud files. This issue is fixed in version 30.2.7.

Read more at https://www.tenable.com/cve/CVE-2026-63373

]]> https://www.tenable.com/cve/CVE-2026-63334 https://www.tenable.com/cve/CVE-2026-63334 Mon, 21 Sep 2026 17:17:39 GMT Medium Severity

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.

Read more at https://www.tenable.com/cve/CVE-2026-63334

]]> https://www.tenable.com/cve/CVE-2026-63116 https://www.tenable.com/cve/CVE-2026-63116 Mon, 21 Sep 2026 17:17:38 GMT High Severity

Description

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_ACTION.PATCH_MULTI from RULES_MAP. When an authenticated user sends a PATCH_MULTI record operation while permission.type is config, getRulesForMessage returns a null rule specification and ConfigPermission.canPerformAction treats the missing specification as an unconditional allow instead of applying RULE_TYPES.WRITE. Any authenticated user can therefore modify arbitrary protected records, corrupt application state, or cause service disruption; deployments using the default permission type none already allow all operations and are not additionally affected. This issue is fixed in version 10.1.1.

Read more at https://www.tenable.com/cve/CVE-2026-63116

]]> https://www.tenable.com/cve/CVE-2026-62987 https://www.tenable.com/cve/CVE-2026-62987 Mon, 21 Sep 2026 17:17:38 GMT Medium Severity

Description

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.

Read more at https://www.tenable.com/cve/CVE-2026-62987

]]> https://www.tenable.com/cve/CVE-2026-62866 https://www.tenable.com/cve/CVE-2026-62866 Mon, 21 Sep 2026 17:17:38 GMT Medium Severity

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across trailing whitespace and then reads the source at the exhausted index without an end-of-input check. A selector ending in whitespace, including input passed through lexer.NewTokenizer(...).Tokenize() or dasel.Query, can therefore cause an index-out-of-range panic and terminate the process. This issue is fixed in version 3.11.2.

Read more at https://www.tenable.com/cve/CVE-2026-62866

]]> https://www.tenable.com/cve/CVE-2026-62371 https://www.tenable.com/cve/CVE-2026-62371 Mon, 21 Sep 2026 17:17:37 GMT High Severity

Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Read more at https://www.tenable.com/cve/CVE-2026-62371

]]> https://www.tenable.com/cve/CVE-2026-62370 https://www.tenable.com/cve/CVE-2026-62370 Mon, 21 Sep 2026 17:17:36 GMT Medium Severity

Description

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/pkg/packer trusts the 32-bit PackageHeader.PayloadLen received through the CloudHub viaduct message-processing path and allocates that amount of memory before validating an upper bound. An authenticated malicious or compromised edge peer can repeatedly send crafted headers with excessive declared lengths, causing memory exhaustion, CloudHub process termination or restart loops, and temporary disruption of cloud-edge communication. This issue does not provide unauthenticated access or direct code execution. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

Read more at https://www.tenable.com/cve/CVE-2026-62370

]]> https://www.tenable.com/cve/CVE-2026-61674 https://www.tenable.com/cve/CVE-2026-61674 Mon, 21 Sep 2026 17:17:36 GMT Critical Severity

Description

Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the server-controlled PONG[2] reason into the 32-byte stack buffer msg with memcpy without checking its MessagePack type or length. An attacker who controls or can impersonate an out_forward Secure Forward destination configured with Shared_Key or Empty_Shared_Key can send an oversized reason during the first handshake and overwrite stack control data. Protected builds reliably terminate, while builds without a stack canary or with a disclosure can allow remote code execution as the Fluent Bit process user. When the opt-in --supervisor mode is used, fork-only respawns preserve the canary and address layout, allowing repeated crash-or-survive probes to support code execution on a hardened build; ordinary exec-based or service-manager restarts do not preserve that state. This issue is fixed in version 5.0.8.

Read more at https://www.tenable.com/cve/CVE-2026-61674

]]> https://www.tenable.com/cve/CVE-2026-59168 https://www.tenable.com/cve/CVE-2026-59168 Mon, 21 Sep 2026 17:17:36 GMT Medium Severity

Description

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, and parsing/xml/reader.go parseElement, recurse once per input nesting level without a depth guard. Deeply nested attacker-controlled JSON or XML supplied through parsing.Format(...).NewReader(...).Read(data), the command-line interface, or the parse selector function can exhaust the Go goroutine stack and raise an unrecoverable fatal error that terminates the entire process. The XML input-size limit does not prevent depth exhaustion, and defer or recover cannot intercept the failure. This issue is fixed in version 3.11.1.

Read more at https://www.tenable.com/cve/CVE-2026-59168

]]> https://www.tenable.com/cve/CVE-2026-58504 https://www.tenable.com/cve/CVE-2026-58504 Mon, 21 Sep 2026 17:17:36 GMT Medium Severity

Description

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io origin when selected cells are processed by TextFormatPanel.addFont() in src/main/webapp/js/grapheditor/Format.js. An HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style but remains in the iteration set. graph.cellRenderer.getLabelValue() returns that plain-text label without HTML encoding, and mxUtils.canConvertHtmlToSvg() parses it as HTML, bypassing the earlier CVE-2026-46642 remediation. Successful exploitation can expose diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim. This issue is fixed in version 30.2.5.

Read more at https://www.tenable.com/cve/CVE-2026-58504

]]> https://www.tenable.com/cve/CVE-2026-17051 https://www.tenable.com/cve/CVE-2026-17051 Mon, 21 Sep 2026 17:17:34 GMT Medium Severity

Description

The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbell register, extracted the payload length with IPC_HEADER_GET_LENGTH(), and passed that length straight to sedi_ipc_read_msg() to copy the message into struct ipm_sedi_context.incoming_data_buf, without checking it against the buffer size. The doorbell length field is 10 bits wide (IPC_HEADER_LENGTH_MASK is 0x03FF), so it can encode up to 1023 bytes, while incoming_data_buf is IPC_DATA_LEN_MAX (128) bytes. The bounds check in the underlying HAL sedi_ipc_read_msg() is a DBG_CHECK that compiles away unless CONFIG_DEBUG is set, so no check remained in a production image. The doorbell register is written by the peer processor on the other side of the IPC link — for the intel_ish_5_* targets, the host CPU's ISH driver, reached through the device's memory-mapped register window. Host-side software with driver-level or raw BAR access can therefore set a length of up to 1023 and cause the interrupt handler to copy far past the destination buffer. The affected path requires an application to have registered an IPM receive callback via ipm_register_callback(), which is the driver's normal mode of use. The result is an out-of-bounds write of up to 895 bytes into static (.bss) memory, performed in interrupt context. The overflow first clobbers the rest of struct ipm_sedi_context — including the k_sem and k_mutex used by the transmit path, whose wait queues contain self-referential list pointers — and then adjacent static data, giving a kernel data-structure corruption and crash primitive. The overflowing bytes are read from registers following the message window, a portion of which are themselves peer-programmable. The fix rejects any doorbell whose encoded length exceeds IPC_DATA_LEN_MAX, logging it and acknowledging the doorbell so the peer is not left waiting.

Read more at https://www.tenable.com/cve/CVE-2026-17051

]]> https://www.tenable.com/cve/CVE-2026-17050 https://www.tenable.com/cve/CVE-2026-17050 Mon, 21 Sep 2026 17:17:34 GMT Medium Severity

Description

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_device.c). On three failure paths — a failed full-length GET_DESCRIPTOR(CONFIGURATION) read, a mismatch between the short and full descriptor reads, and a rejected descriptor in parse_configuration_descriptor() — the buffer was released with k_heap_free() but the pointer was left dangling. The cleanup in usbh_device_free() is guarded only by if (udev->cfg_desc != NULL), so it frees the same block a second time. The path is driven entirely by the attached peripheral: usbh_device_connect() calls usbh_device_init(), which ends in usbh_device_set_configuration(), and on failure usbh_device_connect() calls usbh_device_free(). On v4.4.x this happens during the same enumeration, with no unplug required; on v4.1.0–v4.3.x the second free instead arrives via dev_removed_handler()/dev_connected_handler() in subsys/usb/host/usbh_core.c, so it requires a removal or duplicate-connect event after the failed enumeration — a sequence the attached device fully controls. A malicious or malformed USB device only has to answer the first 9-byte configuration-descriptor request with a well-formed header and then fail any of the three checks, for example by returning a full descriptor whose interface count disagrees with bNumInterfaces, or by answering the second read with different bytes. The result is a double free on usb_device_heap. On builds where lib/heap hardening is active (the current default CONFIG_SYS_HEAP_HARDENING_BASIC), sys_heap_free() detects the already-free chunk and calls k_panic(), giving a deterministic, peripheral-triggered denial of service of the USB host. On builds without that detection — earlier releases, or CONFIG_SYS_HEAP_HARDENING_NONE — the second free manipulates a chunk already on the free list, corrupting the heap's free list so that later allocations can return overlapping or invalid blocks. Exploitation beyond denial of service is bounded by the fact that usb_device_heap is a small dedicated heap (CONFIG_USBH_USB_DEVICE_HEAP, default 1024 bytes) whose only client is this descriptor buffer, and by CONFIG_USB_HOST_STACK being marked experimental and disabled by default. The fix sets udev->cfg_desc = NULL after every k_heap_free(), making the cleanup guard sound.

Read more at https://www.tenable.com/cve/CVE-2026-17050

]]> https://www.tenable.com/cve/CVE-2026-88978 https://www.tenable.com/cve/CVE-2026-88978 Mon, 21 Sep 2026 16:17:26 GMT Medium Severity

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

Read more at https://www.tenable.com/cve/CVE-2026-88978

]]> https://www.tenable.com/cve/CVE-2026-85751 https://www.tenable.com/cve/CVE-2026-85751 Mon, 21 Sep 2026 16:17:25 GMT Critical Severity

Description

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER unset trusted a client-controlled X-Forwarded-By header for header-based proxy authentication. The proxy_hide_header directive in the nginx template at core/nginx/conf/proxy.conf hid the header from upstream responses but did not overwrite the incoming request value in this configuration. An unauthenticated remote attacker could therefore spoof the trusted proxy identity and bypass authentication. This issue is fixed in Mailu 2024.06.55 and Mailu helm-charts 2.7.3.

Read more at https://www.tenable.com/cve/CVE-2026-85751

]]> https://www.tenable.com/cve/CVE-2026-84298 https://www.tenable.com/cve/CVE-2026-84298 Mon, 21 Sep 2026 16:17:24 GMT Low Severity

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.

Read more at https://www.tenable.com/cve/CVE-2026-84298

]]> https://www.tenable.com/cve/CVE-2026-82412 https://www.tenable.com/cve/CVE-2026-82412 Mon, 21 Sep 2026 16:17:24 GMT High Severity

Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept the scan_ports parameter without an administrator gate and pass it through validateSingleWord, which permits shell metacharacters. scripts/lua/modules/vulnerability_scan/vs_utils.lua then concatenates scan_ports into an nmap command in nmap_scan_host and executes the command through ntop.execCmd or ntop.execCmdAsync and popen. Any authenticated non-admin user can execute operating-system commands as the ntopng process account when nmap is available. Because the endpoints accept GET requests while ntopng's CSRF validation applies to POST request bodies, an attacker can also trigger the command through a logged-in user's browser without possessing ntopng credentials. This issue is fixed in version 6.7.260717.

Read more at https://www.tenable.com/cve/CVE-2026-82412

]]> https://www.tenable.com/cve/CVE-2026-77166 https://www.tenable.com/cve/CVE-2026-77166 Mon, 21 Sep 2026 16:17:24 GMT Low Severity

Description

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Read more at https://www.tenable.com/cve/CVE-2026-77166

]]> https://www.tenable.com/cve/CVE-2026-77165 https://www.tenable.com/cve/CVE-2026-77165 Mon, 21 Sep 2026 16:17:23 GMT Medium Severity

Description

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Read more at https://www.tenable.com/cve/CVE-2026-77165

]]> https://www.tenable.com/cve/CVE-2026-63342 https://www.tenable.com/cve/CVE-2026-63342 Mon, 21 Sep 2026 16:17:10 GMT Medium Severity

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.

Read more at https://www.tenable.com/cve/CVE-2026-63342

]]> https://www.tenable.com/cve/CVE-2026-61687 https://www.tenable.com/cve/CVE-2026-61687 Mon, 21 Sep 2026 16:17:09 GMT High Severity

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

Read more at https://www.tenable.com/cve/CVE-2026-61687

]]> https://www.tenable.com/cve/CVE-2026-61681 https://www.tenable.com/cve/CVE-2026-61681 Mon, 21 Sep 2026 16:17:09 GMT Medium Severity

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get() on payload.UnsubscribeURL after VerifyPayload() even though BuildSignature() excludes UnsubscribeURL, allowing an authenticated Hatchet tenant to replace that field in an otherwise valid AWS-signed message with an internal URL. The server-side request can reach EC2 Instance Metadata Service, internal services, and internal HTTP APIs, potentially exposing IAM credentials or network-accessible data and functionality. This issue is fixed in version 0.91.1.

Read more at https://www.tenable.com/cve/CVE-2026-61681

]]> https://www.tenable.com/cve/CVE-2026-55563 https://www.tenable.com/cve/CVE-2026-55563 Mon, 21 Sep 2026 16:17:09 GMT High Severity

Description

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_request_target with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain approval for a benign revision and then run changed code from refs/pull/${{ github.event.pull_request.number }}/merge through privileged make targets. The job exposes GCP, AWS, and Snowflake credentials to that code, enabling runner code execution, credential disclosure, and possible access to downstream cloud resources. An external label-removal integration could mitigate the condition, but no repository workflow provided that protection. This issue is fixed in version 0.65.0.

Read more at https://www.tenable.com/cve/CVE-2026-55563

]]> https://www.tenable.com/cve/CVE-2026-53940 https://www.tenable.com/cve/CVE-2026-53940 Mon, 21 Sep 2026 16:17:09 GMT High Severity

Description

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata. CreatePythonEntryPointAction in conda/core/path_actions.py interpolated that command into target_short_path, and PrefixPathAction.target_full_path joined it to the installation prefix without verifying that the result remained under the intended bin or Scripts directory. create_python_entry_point in conda/gateways/disk/create.py then wrote an executable wrapper to the resulting path. A malicious package could use path separators, traversal segments, or an absolute command path to write outside the prefix or overwrite another in-prefix entry point during default install and environment transactions. Out-of-prefix writes require the target parent directory to exist, while an overwritten entry point can execute attacker-controlled Python when later invoked with the installing user's privileges. This issue is fixed in version 26.5.2.

Read more at https://www.tenable.com/cve/CVE-2026-53940

]]> https://www.tenable.com/cve/CVE-2026-36472 https://www.tenable.com/cve/CVE-2026-36472 Mon, 21 Sep 2026 16:17:08 GMT Medium Severity

Description

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page.

Read more at https://www.tenable.com/cve/CVE-2026-36472

]]> https://www.tenable.com/cve/CVE-2026-36471 https://www.tenable.com/cve/CVE-2026-36471 Mon, 21 Sep 2026 16:17:08 GMT Critical Severity

Description

Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables (including __referer) via a crafted base64-encoded serialized PHP payload submitted as a POST parameter.

Read more at https://www.tenable.com/cve/CVE-2026-36471

]]> https://www.tenable.com/cve/CVE-2026-36470 https://www.tenable.com/cve/CVE-2026-36470 Mon, 21 Sep 2026 16:17:07 GMT Medium Severity

Description

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php.

Read more at https://www.tenable.com/cve/CVE-2026-36470

]]> https://www.tenable.com/cve/CVE-2026-36469 https://www.tenable.com/cve/CVE-2026-36469 Mon, 21 Sep 2026 16:17:07 GMT Critical Severity

Description

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload by URL" functionality).

Read more at https://www.tenable.com/cve/CVE-2026-36469

]]> https://www.tenable.com/cve/CVE-2026-36468 https://www.tenable.com/cve/CVE-2026-36468 Mon, 21 Sep 2026 16:17:07 GMT Medium Severity

Description

Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as ">).

Read more at https://www.tenable.com/cve/CVE-2026-36468

]]> https://www.tenable.com/cve/CVE-2026-36467 https://www.tenable.com/cve/CVE-2026-36467 Mon, 21 Sep 2026 16:17:07 GMT High Severity

Description

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell.

Read more at https://www.tenable.com/cve/CVE-2026-36467

]]> https://www.tenable.com/cve/CVE-2026-94301 https://www.tenable.com/cve/CVE-2026-94301 Mon, 21 Sep 2026 15:17:38 GMT Critical Severity

Description

The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy"), released on 2026-06-02 and announced as "Fully addressed" in MINA 2.2.8, 2.1.13 and 2.0.29, was committed to the 2.2.X branch only. The 2.0.X and 2.1.X maintenance branches never received the resolveProxyClass() override, so the 2.0.29 and 2.1.13 artifacts listed as fixed -- and every later release on those lines, up to and including the current 2.0.30 and 2.1.14 -- remain vulnerable to the exact allow-list bypass that CVE-2026-47065 was meant to close.

Read more at https://www.tenable.com/cve/CVE-2026-94301

]]> https://www.tenable.com/cve/CVE-2026-94184 https://www.tenable.com/cve/CVE-2026-94184 Mon, 21 Sep 2026 15:17:38 GMT High Severity

Description

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.

Read more at https://www.tenable.com/cve/CVE-2026-94184

]]> https://www.tenable.com/cve/CVE-2026-93339 https://www.tenable.com/cve/CVE-2026-93339 Mon, 21 Sep 2026 15:17:35 GMT Medium Severity

Description

Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.

Read more at https://www.tenable.com/cve/CVE-2026-93339

]]> https://www.tenable.com/cve/CVE-2026-86473 https://www.tenable.com/cve/CVE-2026-86473 Mon, 21 Sep 2026 15:17:32 GMT Critical Severity

Description

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid until it expires. An attacker who already holds a copy of that token keeps the victim's access after the victim has logged out and believes the session ended; the default token lifetime is 24 hours and is configurable. Affects API clients that authenticate with a bearer token rather than the browser session cookie. The attacker must already possess a copy of a valid token; obtaining one is outside the scope of this issue, and no privileges beyond the victim's own are gained. Users of apache-airflow are recommended to upgrade to apache-airflow version 3.3.2 or later, which fixes the issue.

Read more at https://www.tenable.com/cve/CVE-2026-86473

]]> https://www.tenable.com/cve/CVE-2026-82355 https://www.tenable.com/cve/CVE-2026-82355 Mon, 21 Sep 2026 15:17:32 GMT Medium Severity

Description

When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie and ignores the bearer token, inverting the intended precedence of bearer over cookie. The request then executes -- and is recorded in the audit log -- as the cookie's principal rather than the identity the client explicitly presented. Only Apache Airflow 3.3.0 and 3.3.1 are affected. Earlier releases do not contain the code path that caches the cookie-derived user, and are not vulnerable. Exploiting this requires an attacker to first place a valid session cookie of their own into the victim's browser or client: for example by cookie tossing from a sibling subdomain, through cross-site scripting in a separate application sharing a parent domain, or via a shared workstation. Deployments that host the Airflow UI on a domain shared with other applications are therefore the most exposed; a deployment on a dedicated domain with no co-hosted applications is not reachable this way. The consequence is principal confusion and misattributed audit records rather than a direct privilege escalation. Users of 3.3.0 or 3.3.1 should upgrade to Apache Airflow 3.3.2 or later, which resolves the caller from the explicitly supplied credential whenever one is present.

Read more at https://www.tenable.com/cve/CVE-2026-82355

]]> https://www.tenable.com/cve/CVE-2026-80110 https://www.tenable.com/cve/CVE-2026-80110 Mon, 21 Sep 2026 15:17:32 GMT High Severity

Description

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy.

Read more at https://www.tenable.com/cve/CVE-2026-80110

]]> https://www.tenable.com/cve/CVE-2026-75939 https://www.tenable.com/cve/CVE-2026-75939 Mon, 21 Sep 2026 15:17:31 GMT High Severity

Description

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.

Read more at https://www.tenable.com/cve/CVE-2026-75939

]]> https://www.tenable.com/cve/CVE-2026-75158 https://www.tenable.com/cve/CVE-2026-75158 Mon, 21 Sep 2026 15:17:31 GMT Medium Severity

Description

Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the caller is authorized to read. Any authenticated user holding asset-read access could therefore enumerate asset events — including the source Dag ID, task ID, run ID and event timestamps — for Dags they have no permission to see. Because the filter was also absent from the count query, `total_entries` and pagination disclosed the existence of hidden Dags even without inspecting individual rows. Deployments are affected whenever per-Dag access control is used to separate teams or tenants; no special configuration is required. Upgrade to apache-airflow 3.3.2 or later.

Read more at https://www.tenable.com/cve/CVE-2026-75158

]]> https://www.tenable.com/cve/CVE-2026-71543 https://www.tenable.com/cve/CVE-2026-71543 Mon, 21 Sep 2026 15:17:31 GMT High Severity

Description

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, PKI, and SSH policies could substitute attacker-controlled identity data without rejecting syntax-significant characters. In ACL templated policies, asterisks, plus signs, and slashes could alter path matching. In PKI allowed_uri_sans_template and allowed_domains policies, an asterisk could broaden certificate issuance to unauthorized domains. In SSH allowed_users and allowed_domains policies, a comma could add unauthorized principals. Exploitation requires a deployment to use templated policy data that users can freely modify; templates based on the randomly generated identity.entity.id value are not affected. This could allow privilege escalation, unauthorized access, and unauthorized certificate issuance. This issue is fixed in version 2.6.0.

Read more at https://www.tenable.com/cve/CVE-2026-71543

]]> https://www.tenable.com/cve/CVE-2026-68919 https://www.tenable.com/cve/CVE-2026-68919 Mon, 21 Sep 2026 15:17:30 GMT High Severity

Description

GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline History views. A user with write access to a material tracked by GoCD can store arbitrary HTML or JavaScript in a forged package material comment, which executes in the browser session of a user who later views an affected page. Exploitation requires a victim to view a page that renders the malicious modification, and GoCD does not render every material comment in every view. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-68919

]]> https://www.tenable.com/cve/CVE-2026-61630 https://www.tenable.com/cve/CVE-2026-61630 Mon, 21 Sep 2026 15:17:30 GMT Medium Severity

Description

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue.

Read more at https://www.tenable.com/cve/CVE-2026-61630

]]> https://www.tenable.com/cve/CVE-2026-61629 https://www.tenable.com/cve/CVE-2026-61629 Mon, 21 Sep 2026 15:17:30 GMT High Severity

Description

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's API server runs in front of every HTTP request and calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header without imposing any size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language tags. The CVE-2022-32149 guard that golang.org/x/text added in v0.3.8 caps the number of `-` characters in the input at 1000, but it does not cap `_` characters even though the parser's internal scanner aliases `_` to `-` before parsing. A single unauthenticated GET request with an `Accept-Language` header built out of `_` separators burns about 2.4 seconds of server CPU on the host running nginx-ignition; ten concurrent attackers saturate a ten-core box for the duration of the attack while consuming ~10 MiB/s of upstream bandwidth. Version 2.40.1 fixes this issue.

Read more at https://www.tenable.com/cve/CVE-2026-61629

]]> https://www.tenable.com/cve/CVE-2026-61628 https://www.tenable.com/cve/CVE-2026-61628 Mon, 21 Sep 2026 15:17:30 GMT High Severity

Description

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

Read more at https://www.tenable.com/cve/CVE-2026-61628

]]> https://www.tenable.com/cve/CVE-2026-55870 https://www.tenable.com/cve/CVE-2026-55870 Mon, 21 Sep 2026 15:17:30 GMT Low Severity

Description

GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and password fields or secret-management plugins, legacy configuration permits credentials in material URLs, and not every mixed-use API consistently applies URL masking for every material type. An authenticated user with access to an affected pipeline can obtain credentials embedded in its material URL, while dedicated password fields remain encrypted and are not exposed by this issue. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-55870

]]> https://www.tenable.com/cve/CVE-2026-55625 https://www.tenable.com/cve/CVE-2026-55625 Mon, 21 Sep 2026 15:17:29 GMT Medium Severity

Description

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipeline group administrator can invoke Test Connection for source control materials outside the administrator's authorized pipeline group or configuration repository and potentially use credentials from those materials. For GoCD 20.6.0 and later, the test context can also resolve external secrets managed by secret-management plugins, including global reusable secrets with separate permissions. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-55625

]]> https://www.tenable.com/cve/CVE-2026-55567 https://www.tenable.com/cve/CVE-2026-55567 Mon, 21 Sep 2026 15:17:29 GMT High Severity

Description

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect the elevated deletion to an attacker-selected file. The arbitrary privileged file deletion can be combined with Windows Installer behavior to obtain local SYSTEM privileges. This issue is fixed in version 6.0.1.

Read more at https://www.tenable.com/cve/CVE-2026-55567

]]> https://www.tenable.com/cve/CVE-2026-55074 https://www.tenable.com/cve/CVE-2026-55074 Mon, 21 Sep 2026 15:17:29 GMT High Severity

Description

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.

Read more at https://www.tenable.com/cve/CVE-2026-55074

]]> https://www.tenable.com/cve/CVE-2026-55071 https://www.tenable.com/cve/CVE-2026-55071 Mon, 21 Sep 2026 15:17:29 GMT High Severity

Description

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.

Read more at https://www.tenable.com/cve/CVE-2026-55071

]]> https://www.tenable.com/cve/CVE-2026-55060 https://www.tenable.com/cve/CVE-2026-55060 Mon, 21 Sep 2026 15:17:29 GMT Low Severity

Description

GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended administrator-only authorization. An authenticated internal user can query the endpoint while source control child processes are running and view command-line arguments, usernames, remote material URLs, and internal material paths for materials the user cannot otherwise access. Exploitation depends on unpredictable process timing, and credentials, environment variables, and user-defined secrets remain masked or omitted. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-55060

]]> https://www.tenable.com/cve/CVE-2026-54584 https://www.tenable.com/cve/CVE-2026-54584 Mon, 21 Sep 2026 15:17:29 GMT Medium Severity

Description

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to an attacker-controlled location. PR 123 ignores unsafe TMPDIR values in privileged contexts and rejects empty TMPDIR. This issue has been patched in version 2.7.8.

Read more at https://www.tenable.com/cve/CVE-2026-54584

]]> https://www.tenable.com/cve/CVE-2026-52743 https://www.tenable.com/cve/CVE-2026-52743 Mon, 21 Sep 2026 15:17:28 GMT Medium Severity

Description

GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retrieve status for jobs in pipelines the user cannot otherwise view, including job names, state, progress timestamps, assigned agent IP addresses and UUIDs, and associated stages and pipelines. The response does not expose console output, artifacts, commands, variables, or configuration. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-52743

]]> https://www.tenable.com/cve/CVE-2026-52742 https://www.tenable.com/cve/CVE-2026-52742 Mon, 21 Sep 2026 15:17:28 GMT Medium Severity

Description

GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configuration to pipeline group administrators instead of restricting responses to configuration for groups they administer. The disclosed configuration can include agent auto-registration keys, webhook invocation keys, encrypted material credentials, and GoCD administrator lists. A malicious pipeline group administrator can use disclosed agent registration data to connect a rogue compatible agent, which can create a higher-complexity path to receiving work or overwriting artifacts associated with other groups. Normal authenticated users are not affected, the endpoint does not modify server configuration, and deployments that restrict pipeline editing to full administrators or configuration repositories are not affected. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-52742

]]> https://www.tenable.com/cve/CVE-2026-52741 https://www.tenable.com/cve/CVE-2026-52741 Mon, 21 Sep 2026 15:17:28 GMT High Severity

Description

GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-tool links from commit comments when a project uses a lenient Tracking Tool regular expression with an ID capturing group, such as JIRA-(.+). An attacker with commit access to a tracked material can place URI or HTML special characters in a matching commit comment, causing stored cross-site scripting when a victim views an affected Compare Pipeline page. Deployments without Tracking Tool integration, without an ID capturing group, or with conservative matchers that cannot match special characters are not affected. Successful exploitation can expose a privileged user session or allow changes using the victim's credentials and privileges. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-52741

]]> https://www.tenable.com/cve/CVE-2026-52740 https://www.tenable.com/cve/CVE-2026-52740 Mon, 21 Sep 2026 15:17:28 GMT Medium Severity

Description

GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when selecting authorization filters. A lower-privileged authenticated user can send a request with nonstandard HTTP method capitalization to retrieve a pipeline template by name without the required view permission and read its configuration. API operations that modify data are not affected, secure variables remain encrypted, and deployments whose reverse proxy rejects non-uppercase HTTP methods are not affected. This issue is fixed in version 26.1.0.

Read more at https://www.tenable.com/cve/CVE-2026-52740

]]> https://www.tenable.com/cve/CVE-2026-94404 https://www.tenable.com/cve/CVE-2026-94404 Mon, 21 Sep 2026 14:17:31 GMT High Severity

Description

MISP has a security issue that could let an attacker change threat-intelligence data through a logged-in user’s browser without that user knowingly approving the change. The affected function did not properly enforce MISP’s usual protection against forged requests. Because of this, an attacker could create a malicious webpage that silently sends a request to MISP when visited by an authenticated user. If successful, the attacker could change details of an attribute, such as its value, type, category, comment, distribution settings, or related timestamps. The attack requires the victim to already be logged in to MISP and to visit an attacker-controlled page. The main impact is unauthorized modification of threat-intelligence data, which could lead to incorrect indicators, wrong classifications, or altered sharing settings and reduce confidence in the accuracy of the information stored in MISP. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94404

]]> https://www.tenable.com/cve/CVE-2026-94401 https://www.tenable.com/cve/CVE-2026-94401 Mon, 21 Sep 2026 14:17:30 GMT High Severity

Description

MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services. When importing an XML file, MISP did not properly verify that the uploaded content was actually XML. Because of this, a user with permission to modify data could upload a file containing a local file path or a web address instead. If a local file path was supplied, MISP could read that file from the server. If a URL was supplied, MISP could make a request to that address, including systems that may only be reachable from inside the organization’s network. The vulnerability could therefore expose sensitive local files and allow unauthorized requests to internal services. Exploitation required a valid MISP account with modify permissions, but no additional user interaction was needed. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94401

]]> https://www.tenable.com/cve/CVE-2026-94394 https://www.tenable.com/cve/CVE-2026-94394 Mon, 21 Sep 2026 14:17:30 GMT Medium Severity

Description

When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whether the individual pieces of data are also allowed for that user. Because of this, someone who can view an event could potentially access attributes or objects inside that event that were meant to be restricted to a specific sharing group or distribution level. The vulnerability affects authenticated users who are not site administrators and who already have access to an event containing more restricted data. The main impact is that users may be able to view sensitive attribute values, object details, or related object data that they should not normally be allowed to see.

Read more at https://www.tenable.com/cve/CVE-2026-94394

]]> https://www.tenable.com/cve/CVE-2026-94393 https://www.tenable.com/cve/CVE-2026-94393 Mon, 21 Sep 2026 14:17:30 GMT Medium Severity

Description

When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentially move a report from another event into their own event, as long as they know or can guess the report’s UUID. Once moved, they could view and change information that they were not originally allowed to access. The vulnerability requires the attacker to have editor access to at least one event and to know or discover a valid report UUID. The main impact is that private event reports could be exposed or modified across event boundaries, bypassing MISP’s normal access restrictions. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94393

]]> https://www.tenable.com/cve/CVE-2026-94387 https://www.tenable.com/cve/CVE-2026-94387 Mon, 21 Sep 2026 14:17:30 GMT Medium Severity

Description

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

Read more at https://www.tenable.com/cve/CVE-2026-94387

]]> https://www.tenable.com/cve/CVE-2026-94382 https://www.tenable.com/cve/CVE-2026-94382 Mon, 21 Sep 2026 14:17:30 GMT Low Severity

Description

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

Read more at https://www.tenable.com/cve/CVE-2026-94382

]]> https://www.tenable.com/cve/CVE-2026-93884 https://www.tenable.com/cve/CVE-2026-93884 Mon, 21 Sep 2026 14:17:30 GMT Severity Not Scored

Description

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

Read more at https://www.tenable.com/cve/CVE-2026-93884

]]> https://www.tenable.com/cve/CVE-2026-88807 https://www.tenable.com/cve/CVE-2026-88807 Mon, 21 Sep 2026 14:17:22 GMT High Severity

Description

A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

Read more at https://www.tenable.com/cve/CVE-2026-88807

]]> https://www.tenable.com/cve/CVE-2026-88806 https://www.tenable.com/cve/CVE-2026-88806 Mon, 21 Sep 2026 14:17:22 GMT High Severity

Description

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.

Read more at https://www.tenable.com/cve/CVE-2026-88806

]]> https://www.tenable.com/cve/CVE-2026-85220 https://www.tenable.com/cve/CVE-2026-85220 Mon, 21 Sep 2026 14:17:22 GMT Low Severity

Description

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled. Thinkst has addressed this issue on all supported platforms. New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries. Workarounds are available for customers unable to update at this time.

Read more at https://www.tenable.com/cve/CVE-2026-85220

]]> https://www.tenable.com/cve/CVE-2025-71421 https://www.tenable.com/cve/CVE-2025-71421 Mon, 21 Sep 2026 14:17:14 GMT High Severity

Description

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege to escalate their own role to administrator. Attackers can submit their own account identifier with a role parameter set to ROLE_ADMIN to gain full administrative control over agents, tickets, and mail configuration.

Read more at https://www.tenable.com/cve/CVE-2025-71421

]]> https://www.tenable.com/cve/CVE-2025-71420 https://www.tenable.com/cve/CVE-2025-71420 Mon, 21 Sep 2026 14:17:14 GMT Medium Severity

Description

UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers and read content reserved for groups and teams they do not belong to.

Read more at https://www.tenable.com/cve/CVE-2025-71420

]]> https://www.tenable.com/cve/CVE-2025-71419 https://www.tenable.com/cve/CVE-2025-71419 Mon, 21 Sep 2026 14:17:14 GMT Medium Severity

Description

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

Read more at https://www.tenable.com/cve/CVE-2025-71419

]]> https://www.tenable.com/cve/CVE-2026-94383 https://www.tenable.com/cve/CVE-2026-94383 Mon, 21 Sep 2026 13:17:13 GMT High Severity

Description

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename() to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary extension that would be placed in the MISP export directory. If the underlying web server is configured to interpret and execute scripts from that directory, the resulting file could be invoked, leading to arbitrary code execution in the context of the web server process. The vulnerability requires the attacker to hold site-administrator privileges within MISP, as the blocklist workflow module is restricted to that role. No additional user interaction is required beyond triggering the workflow action with a crafted filename parameter. The impact is full compromise of the MISP server's confidentiality, integrity, and availability, as arbitrary script execution grants the attacker the same privileges as the web server user. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94383

]]> https://www.tenable.com/cve/CVE-2026-94381 https://www.tenable.com/cve/CVE-2026-94381 Mon, 21 Sep 2026 13:17:13 GMT High Severity

Description

MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someone view information. However, after logging in with such a key, a specific MISP function could accidentally restore the user’s normal account permissions. This means someone with a read-only API key could potentially gain write, delete, or even administrator access if their underlying account has those permissions. Exploiting the issue requires a valid read-only API key and a single request to the affected function. The main impact is that MISP’s API key restrictions can be bypassed, allowing actions that the API key was specifically meant to prevent. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94381

]]> https://www.tenable.com/cve/CVE-2026-94379 https://www.tenable.com/cve/CVE-2026-94379 Mon, 21 Sep 2026 13:17:13 GMT Medium Severity

Description

The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods (POST and PUT) before enforcing bruteforce protection, email one-time-password (OTP) verification, and login-failure logging. Because the checks were not exhaustive, an unauthenticated attacker could issue login requests using other HTTP methods and bypass all three security controls simultaneously. Specifically: - the bruteforce blocklisting check and attempt counter were skipped, allowing unlimited credential-guessing attempts without being rate-limited or blocked - the email OTP two-factor authentication step was skipped, defeating the second factor of authentication - login-failure events were neither logged nor counted, removing the audit trail and the mechanism that would normally trigger a blocklist entry. The security impact is the effective disabling of brute-force protection and multi-factor authentication for any attacker who can craft an HTTP request with a non-POST/PUT method to the login endpoint, potentially leading to credential compromise and unauthorized access to the MISP instance. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94379

]]> https://www.tenable.com/cve/CVE-2026-94374 https://www.tenable.com/cve/CVE-2026-94374 Mon, 21 Sep 2026 13:17:12 GMT High Severity

Description

MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the adjacent attribute and object processing loops, the report loop did not unset the client-supplied 'id' field before calling save(). Because the MISP EventReport model's create() method does not strip the id field, an authenticated user with permission to submit module results could include an 'id' value referencing an existing report belonging to a different event. Upon save(), the ORM would update that existing row rather than insert a new one, allowing the attacker to - read the content of another event's report by reparenting it into their own event - overwrite the report's fields with attacker-controlled data - change the report's event_id to redirect ownership. This constitutes an authorization bypass through a user-controlled key, enabling cross-event data disclosure and integrity compromise. The vulnerability requires an authenticated session with the ability to invoke module result processing on an event. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94374

]]> https://www.tenable.com/cve/CVE-2026-94373 https://www.tenable.com/cve/CVE-2026-94373 Mon, 21 Sep 2026 13:17:12 GMT Medium Severity

Description

MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim's browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94373

]]> https://www.tenable.com/cve/CVE-2026-94372 https://www.tenable.com/cve/CVE-2026-94372 Mon, 21 Sep 2026 13:17:12 GMT Medium Severity

Description

MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the default theme, these sample tag names were inserted into the HTML output without HTML-entity encoding. A user with tag-editor privileges could craft a malicious misp-galaxy tag containing arbitrary script. When a site administrator subsequently viewed the Galaxies index page, the crafted tag content was interpreted as executable markup in the administrator's browser session, enabling the attacker to read session data, perform actions on behalf of the administrator, or otherwise compromise the administrator's browser context. The Overmind theme already applied HTML escaping to the same values and was not affected. The vulnerability requires the attacker to possess tag-editor-level access to create the crafted tag and requires the victim (a site administrator) to view the Galaxies index page in the default theme. The impact is limited to the administrator's browser session and does not directly compromise the MISP server process. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94372

]]> https://www.tenable.com/cve/CVE-2026-94216 https://www.tenable.com/cve/CVE-2026-94216 Mon, 21 Sep 2026 13:17:12 GMT Medium Severity

Description

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94216

]]> https://www.tenable.com/cve/CVE-2026-94214 https://www.tenable.com/cve/CVE-2026-94214 Mon, 21 Sep 2026 13:17:12 GMT Medium Severity

Description

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the file /login.html of the component Management Service. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94214

]]> https://www.tenable.com/cve/CVE-2026-94211 https://www.tenable.com/cve/CVE-2026-94211 Mon, 21 Sep 2026 13:17:11 GMT Medium Severity

Description

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. "EDIT perm" needed to plant; fires cross-user for anyone viewing the project dashboard since the poisoned label name is echoed raw. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94211

]]> https://www.tenable.com/cve/CVE-2026-84285 https://www.tenable.com/cve/CVE-2026-84285 Mon, 21 Sep 2026 13:17:10 GMT High Severity

Description

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.

Read more at https://www.tenable.com/cve/CVE-2026-84285

]]> https://www.tenable.com/cve/CVE-2026-94368 https://www.tenable.com/cve/CVE-2026-94368 Mon, 21 Sep 2026 12:17:29 GMT High Severity

Description

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the service fails to reject requests containing unsigned x-amz- headers, instead simply dropping them from the signature calculation. This allows an attacker who possesses a valid presigned PUT URL to add an unsigned x-amz-copy-source header, effectively converting a simple upload into a CopyObject operation. This can lead to unauthorized access and copying of any data the original signer is permitted to reach across the entire storage system.

Read more at https://www.tenable.com/cve/CVE-2026-94368

]]> https://www.tenable.com/cve/CVE-2026-94210 https://www.tenable.com/cve/CVE-2026-94210 Mon, 21 Sep 2026 12:17:27 GMT Medium Severity

Description

A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: a30a6837b4071ac05a4f58d0e1baa2c62aa8695e. To fix this issue, it is recommended to deploy a patch.

Read more at https://www.tenable.com/cve/CVE-2026-94210

]]> https://www.tenable.com/cve/CVE-2026-91867 https://www.tenable.com/cve/CVE-2026-91867 Mon, 21 Sep 2026 12:17:25 GMT Medium Severity

Description

When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Read more at https://www.tenable.com/cve/CVE-2026-91867

]]> https://www.tenable.com/cve/CVE-2026-91866 https://www.tenable.com/cve/CVE-2026-91866 Mon, 21 Sep 2026 12:17:25 GMT High Severity

Description

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Read more at https://www.tenable.com/cve/CVE-2026-91866

]]> https://www.tenable.com/cve/CVE-2026-91865 https://www.tenable.com/cve/CVE-2026-91865 Mon, 21 Sep 2026 12:17:24 GMT High Severity

Description

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Read more at https://www.tenable.com/cve/CVE-2026-91865

]]> https://www.tenable.com/cve/CVE-2026-91864 https://www.tenable.com/cve/CVE-2026-91864 Mon, 21 Sep 2026 12:17:24 GMT High Severity

Description

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Read more at https://www.tenable.com/cve/CVE-2026-91864

]]> https://www.tenable.com/cve/CVE-2026-91863 https://www.tenable.com/cve/CVE-2026-91863 Mon, 21 Sep 2026 12:17:24 GMT High Severity

Description

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.

Read more at https://www.tenable.com/cve/CVE-2026-91863

]]> https://www.tenable.com/cve/CVE-2026-89139 https://www.tenable.com/cve/CVE-2026-89139 Mon, 21 Sep 2026 12:17:24 GMT High Severity

Description

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller's choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group's compute provider type is subprocess.

Read more at https://www.tenable.com/cve/CVE-2026-89139

]]> https://www.tenable.com/cve/CVE-2026-87858 https://www.tenable.com/cve/CVE-2026-87858 Mon, 21 Sep 2026 12:17:22 GMT High Severity

Description

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.

Read more at https://www.tenable.com/cve/CVE-2026-87858

]]> https://www.tenable.com/cve/CVE-2026-65654 https://www.tenable.com/cve/CVE-2026-65654 Mon, 21 Sep 2026 12:17:16 GMT High Severity

Description

github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a live Ringpop TChannel listener can repeatedly submit changes for distinct member addresses containing label keys, values, or counts that exceed the receiver's configured limits. Accepted labels are retained in the member list and disseminated to peers, allowing memory and gossip-bandwidth consumption to exceed configured bounds and potentially making the hosting process unavailable. The fix validates peer-supplied label maps before they are retained or disseminated. Availability only; no confidentiality or integrity impact was identified.

Read more at https://www.tenable.com/cve/CVE-2026-65654

]]> https://www.tenable.com/cve/CVE-2026-65653 https://www.tenable.com/cve/CVE-2026-65653 Mon, 21 Sep 2026 12:17:15 GMT High Severity

Description

github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can supply such a malformed call fragment, including as a direct initial call request after completing the standard initialization handshake. On that inbound path, the resulting unrecovered Go slice-bounds panic occurs on a library-created dispatch goroutine and terminates the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

Read more at https://www.tenable.com/cve/CVE-2026-65653

]]> https://www.tenable.com/cve/CVE-2026-65652 https://www.tenable.com/cve/CVE-2026-65652 Mon, 21 Sep 2026 12:17:15 GMT High Severity

Description

github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksum type. The parser uses that value as an index into a four-entry checksum pool, causing an unrecovered Go panic on the connection read goroutine and terminating the hosting process. This allows remote denial of service against applications that expose the listener to untrusted peers. The impact is limited to availability; no confidentiality or integrity impact was identified.

Read more at https://www.tenable.com/cve/CVE-2026-65652

]]> https://www.tenable.com/cve/CVE-2026-65651 https://www.tenable.com/cve/CVE-2026-65651 Mon, 21 Sep 2026 12:17:15 GMT High Severity

Description

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses attacker-controlled SQL and later formats or walks the returned tree can encounter a runtime-fatal Go stack overflow that terminates the process; Go panic recovery cannot contain this condition. Temporal Server passes caller-controlled query input through the affected parser in archival, visibility, and worker-query paths. In affected validation paths, the Server recursively formats an invalid expression while constructing an error. In a supported authenticated deployment, a caller with namespace read permission can terminate the receiving Frontend or Matching process. The dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

Read more at https://www.tenable.com/cve/CVE-2026-65651

]]> https://www.tenable.com/cve/CVE-2026-16652 https://www.tenable.com/cve/CVE-2026-16652 Mon, 21 Sep 2026 12:17:10 GMT High Severity

Description

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

Read more at https://www.tenable.com/cve/CVE-2026-16652

]]> https://www.tenable.com/cve/CVE-2026-16651 https://www.tenable.com/cve/CVE-2026-16651 Mon, 21 Sep 2026 12:17:10 GMT High Severity

Description

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The resulting Go runtime panic propagates unless the caller recovers it on the parsing goroutine, so applications that parse attacker-controlled SQL can terminate. Temporal Server exposes the affected parser through ListWorkers. When that API is enabled, an authenticated caller with namespace read permission can submit a malformed query that terminates the receiving Matching process. Repeated requests can sustain a denial of service. The issue affects availability only; no confidentiality or integrity impact was identified.

Read more at https://www.tenable.com/cve/CVE-2026-16651

]]> https://www.tenable.com/cve/CVE-2026-92612 https://www.tenable.com/cve/CVE-2026-92612 Mon, 21 Sep 2026 11:17:12 GMT Low Severity

Description

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavior using entirely safe Rust.

Read more at https://www.tenable.com/cve/CVE-2026-92612

]]> https://www.tenable.com/cve/CVE-2026-77021 https://www.tenable.com/cve/CVE-2026-77021 Mon, 21 Sep 2026 11:17:12 GMT Medium Severity

Description

Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib compressed payload that decompresses to an arbitrary size.

Read more at https://www.tenable.com/cve/CVE-2026-77021

]]> https://www.tenable.com/cve/CVE-2026-94277 https://www.tenable.com/cve/CVE-2026-94277 Mon, 21 Sep 2026 10:17:17 GMT Medium Severity

Description

MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a galaxy whose name contains arbitrary HTML or JavaScript markup. Because the value is interpolated verbatim into the page, any user who subsequently opens the galaxy matrix statistics page will have the embedded script executed in their browser context. This enables session hijacking, credential theft, data exfiltration, or the performance of arbitrary actions on behalf of the victim within the MISP application. Version affected: <2.5.47

Read more at https://www.tenable.com/cve/CVE-2026-94277

]]> https://www.tenable.com/cve/CVE-2026-92574 https://www.tenable.com/cve/CVE-2026-92574 Mon, 21 Sep 2026 10:17:17 GMT High Severity

Description

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration. This can allow execution with elevated privileges across the container security boundary. Affected upstream supported versions are CRI-O 1.34 and later. Downstream Red Hat products are affected from OCP 4.17 onward. Fixes have been applied to supported branches but are not yet released. Exploitation requires permission to create a pod from a malicious checkpoint image and checkpoint restore functionality to be available.

Read more at https://www.tenable.com/cve/CVE-2026-92574

]]> https://www.tenable.com/cve/CVE-2026-91921 https://www.tenable.com/cve/CVE-2026-91921 Mon, 21 Sep 2026 10:17:15 GMT Medium Severity

Description

Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax and certain unsanitised content blocks. The impact is limited to the user’s own interactive session; no compromise of internal infrastructure, access to third-party data or impact on administrative panels has been identified.

Read more at https://www.tenable.com/cve/CVE-2026-91921

]]> https://www.tenable.com/cve/CVE-2026-94152 https://www.tenable.com/cve/CVE-2026-94152 Mon, 21 Sep 2026 09:17:06 GMT Medium Severity

Description

A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94152

]]> https://www.tenable.com/cve/CVE-2026-94151 https://www.tenable.com/cve/CVE-2026-94151 Mon, 21 Sep 2026 09:17:06 GMT Medium Severity

Description

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94151

]]> https://www.tenable.com/cve/CVE-2026-94150 https://www.tenable.com/cve/CVE-2026-94150 Mon, 21 Sep 2026 09:17:06 GMT Medium Severity

Description

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94150

]]> https://www.tenable.com/cve/CVE-2026-92400 https://www.tenable.com/cve/CVE-2026-92400 Mon, 21 Sep 2026 09:17:06 GMT Medium Severity

Description

The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.

Read more at https://www.tenable.com/cve/CVE-2026-92400

]]> https://www.tenable.com/cve/CVE-2026-86802 https://www.tenable.com/cve/CVE-2026-86802 Mon, 21 Sep 2026 09:17:06 GMT Low Severity

Description

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

Read more at https://www.tenable.com/cve/CVE-2026-86802

]]> https://www.tenable.com/cve/CVE-2026-85113 https://www.tenable.com/cve/CVE-2026-85113 Mon, 21 Sep 2026 09:17:06 GMT Medium Severity

Description

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.

Read more at https://www.tenable.com/cve/CVE-2026-85113

]]> https://www.tenable.com/cve/CVE-2026-85010 https://www.tenable.com/cve/CVE-2026-85010 Mon, 21 Sep 2026 09:17:05 GMT Medium Severity

Description

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.

Read more at https://www.tenable.com/cve/CVE-2026-85010

]]> https://www.tenable.com/cve/CVE-2026-15801 https://www.tenable.com/cve/CVE-2026-15801 Mon, 21 Sep 2026 09:17:05 GMT High Severity

Description

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem. Successful exploitation requires that container checkpoint and restore functionality is enabled, which is not the default configuration. An attacker must also be able to trigger restoration of a container from untrusted checkpoint content.

Read more at https://www.tenable.com/cve/CVE-2026-15801

]]> https://www.tenable.com/cve/CVE-2025-12999 https://www.tenable.com/cve/CVE-2025-12999 Mon, 21 Sep 2026 09:17:04 GMT Critical Severity

Description

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix request headers, with no check on whether the sender was a trusted proxy, falling back to the client-supplied Host header. Those responses are cached under keys that do not include the host (extension.json since 0.6.0, namespace.details.json since 0.9.0, sitemap since 0.14.5, latest.extension.version.vscode since 0.34.2). A single request carrying a forged header therefore places attacker-chosen URLs into an entry served to every other client for the lifetime of that entry — one hour by default, and cluster-wide where ovsx.redis.enabled is set. The VSIX download URL, its signature URL and the public key URL are all derived from the same base URL, so extension signing does not limit the impact: an attacker who poisons an entry supplies the package, the signature over it, and the key used to verify it. Exploitability depends on deployment topology. A server reachable directly by clients, or fronted by a proxy that relays the client's X-Forwarded-Host rather than overwriting it, is exploitable by an unauthenticated remote attacker. A proxy that overwrites the header is not. An unauthenticated attacker can poison Open VSX's per-extension metadata cache with attacker-controlled download, signature, and public-key URLs by supplying a crafted X-Forwarded-Host header, causing downstream VS Code-compatible editors to fetch and install a malicious VSIX. Workarounds (unpatched versions) 1. Configure the reverse proxy to set rather than relay X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Prefix — note that nginx's $host is the client's Host header and is not a safe value. 2. Ensure the server is not reachable except through that proxy. 3. Flush the caches afterwards; poisoned entries survive the configuration change.

Read more at https://www.tenable.com/cve/CVE-2025-12999

]]> https://www.tenable.com/cve/CVE-2026-94149 https://www.tenable.com/cve/CVE-2026-94149 Mon, 21 Sep 2026 08:16:39 GMT Medium Severity

Description

A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to improper control of resource identifiers. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94149

]]> https://www.tenable.com/cve/CVE-2026-94148 https://www.tenable.com/cve/CVE-2026-94148 Mon, 21 Sep 2026 08:16:38 GMT Medium Severity

Description

A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.

Read more at https://www.tenable.com/cve/CVE-2026-94148

]]> https://www.tenable.com/cve/CVE-2026-47321 https://www.tenable.com/cve/CVE-2026-47321 Mon, 21 Sep 2026 08:16:37 GMT High Severity

Description

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an exhaustion of the application memory, as we don't control the deflated size. The fix adds such a control by allowing the application developer to provide a fixed size limit, which when reached throws an exception. It also allows the user to provide a compression ratio that should not be exceeded, protected the application from small inflated files that inflate in gigantic files, but with a grace limit for the resulting size (1Mb) to avoid false positive (like a very small file inflating with a high ratio, but resulting with a acceptable size, like a few thousands bytes) For application using this feature, it is highly recommended to create the CompressionFilter and to pass the maximum limit as a forth constructor parameter, maxDecompressedSize: public CompressionFilter(final boolean compressInbound, final boolean compressOutbound, final int compressionLevel, final int maxDecompressedSize)Optionally one can also provide a maxDecompressRatio fifth parameter, and a decompressRatioMinSize sixth parameter to allow small inflated files with a high compression ratio to still be accepted. Here are the additional constructor: public CompressionFilter(final boolean compressInbound, final boolean compressOutbound, final int compressionLevel, final int maxDecompressedSize, final long maxDecompressRatio, final long decompressRatioMinSize) Also note that a fluent API has been added to spare the users the pain to call a constructor with that many parameters: CompressionFilter compressionFilter = new CompressionFilter() .setCompressionLevel(Zlib.COMPRESSION_MAX) .setMaxDecompressedSize(1_000_000) .setMaxDecompressRatio(100). .setDecompressRatioMinSize(100_000); Applications using Apache MINA are advised to upgrade and configure their CompressionFilter instance.

Read more at https://www.tenable.com/cve/CVE-2026-47321

]]> https://www.tenable.com/cve/CVE-2026-94218 https://www.tenable.com/cve/CVE-2026-94218 Mon, 21 Sep 2026 07:16:54 GMT Low Severity

Description

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

Read more at https://www.tenable.com/cve/CVE-2026-94218

]]> https://www.tenable.com/cve/CVE-2026-94217 https://www.tenable.com/cve/CVE-2026-94217 Mon, 21 Sep 2026 07:16:54 GMT Low Severity

Description

A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one user requests an authorization token. This allows an attacker to gain access scopes on a victim's resource that were never intended to be shared.

Read more at https://www.tenable.com/cve/CVE-2026-94217

]]> https://www.tenable.com/cve/CVE-2026-94215 https://www.tenable.com/cve/CVE-2026-94215 Mon, 21 Sep 2026 07:16:54 GMT Medium Severity

Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the request path. This allows an administrator with limited privileges to read or modify sensitive client configurations in the master realm by accessing them through a realm they control. Successful exploitation could lead to the exposure of client credentials or the redirection of administrative login attempts to malicious sites.

Read more at https://www.tenable.com/cve/CVE-2026-94215

]]> https://www.tenable.com/cve/CVE-2026-94213 https://www.tenable.com/cve/CVE-2026-94213 Mon, 21 Sep 2026 07:16:54 GMT Medium Severity

Description

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization checks, a delegated administrator with limited viewing privileges can access the full profile and role information of any user in the realm, even if they are not permitted to view user details. This could lead to the exposure of sensitive information such as email addresses and assigned security roles.

Read more at https://www.tenable.com/cve/CVE-2026-94213

]]> https://www.tenable.com/cve/CVE-2026-94146 https://www.tenable.com/cve/CVE-2026-94146 Mon, 21 Sep 2026 07:16:53 GMT Critical Severity

Description

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94146

]]> https://www.tenable.com/cve/CVE-2026-94145 https://www.tenable.com/cve/CVE-2026-94145 Mon, 21 Sep 2026 07:16:53 GMT Medium Severity

Description

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/author leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94145

]]> https://www.tenable.com/cve/CVE-2026-94144 https://www.tenable.com/cve/CVE-2026-94144 Mon, 21 Sep 2026 07:16:53 GMT Medium Severity

Description

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94144

]]> https://www.tenable.com/cve/CVE-2026-90860 https://www.tenable.com/cve/CVE-2026-90860 Mon, 21 Sep 2026 07:16:53 GMT High Severity

Description

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

Read more at https://www.tenable.com/cve/CVE-2026-90860

]]> https://www.tenable.com/cve/CVE-2026-82187 https://www.tenable.com/cve/CVE-2026-82187 Mon, 21 Sep 2026 07:16:53 GMT Critical Severity

Description

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.

Read more at https://www.tenable.com/cve/CVE-2026-82187

]]> https://www.tenable.com/cve/CVE-2026-94143 https://www.tenable.com/cve/CVE-2026-94143 Mon, 21 Sep 2026 06:17:02 GMT Medium Severity

Description

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94143

]]> https://www.tenable.com/cve/CVE-2026-94142 https://www.tenable.com/cve/CVE-2026-94142 Mon, 21 Sep 2026 05:16:42 GMT Critical Severity

Description

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub_1105C of the file BS_HWMIO64_W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where condition. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94142

]]> https://www.tenable.com/cve/CVE-2026-94139 https://www.tenable.com/cve/CVE-2026-94139 Mon, 21 Sep 2026 05:16:41 GMT Medium Severity

Description

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /send_order.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument session_id causes command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94139

]]> https://www.tenable.com/cve/CVE-2026-90839 https://www.tenable.com/cve/CVE-2026-90839 Mon, 21 Sep 2026 05:16:41 GMT Severity Not Scored

Description

Rejected reason: this is rejected

Read more at https://www.tenable.com/cve/CVE-2026-90839

]]> https://www.tenable.com/cve/CVE-2026-94138 https://www.tenable.com/cve/CVE-2026-94138 Mon, 21 Sep 2026 04:17:37 GMT Medium Severity

Description

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /send_order.cgi?parameter=del_expmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94138

]]> https://www.tenable.com/cve/CVE-2026-94137 https://www.tenable.com/cve/CVE-2026-94137 Mon, 21 Sep 2026 04:17:36 GMT Medium Severity

Description

A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the function sub_180004AC0 of the file shdrv_x64.sys of the component IRP_MJ_DEVICE_CONTROL Handler. The manipulation of the argument PID leads to denial of service. The attack must be carried out locally.

Read more at https://www.tenable.com/cve/CVE-2026-94137

]]> https://www.tenable.com/cve/CVE-2026-94185 https://www.tenable.com/cve/CVE-2026-94185 Mon, 21 Sep 2026 03:16:34 GMT Medium Severity

Description

nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the requested name onto that directory and read the result with no containment check, so a name containing a `..` component escaped the alias directory; under the default layout an alias such as `../../.npmrc` resolves to a file in the user's home directory. nvm_print_alias_file() then emits every non-comment, non-empty line of whatever was opened. A version string taken from an untrusted .nvmrc reaches this path, so a developer who runs `nvm use`, `nvm install`, or `nvm which` inside an attacker-supplied repository discloses the first non-comment line of an arbitrary file readable by that user, in the resulting "is not yet installed" error message. A user-supplied `nvm alias ` discloses every non-comment line of the target file. There is no integrity or availability impact, and no command execution on this path.

Read more at https://www.tenable.com/cve/CVE-2026-94185

]]> https://www.tenable.com/cve/CVE-2026-94129 https://www.tenable.com/cve/CVE-2026-94129 Mon, 21 Sep 2026 02:16:54 GMT Critical Severity

Description

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress results in write-what-where condition. The attack needs to be approached locally. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94129

]]> https://www.tenable.com/cve/CVE-2026-94128 https://www.tenable.com/cve/CVE-2026-94128 Mon, 21 Sep 2026 02:16:54 GMT Critical Severity

Description

A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94128

]]> https://www.tenable.com/cve/CVE-2026-94110 https://www.tenable.com/cve/CVE-2026-94110 Mon, 21 Sep 2026 02:16:53 GMT Medium Severity

Description

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.

Read more at https://www.tenable.com/cve/CVE-2026-94110

]]> https://www.tenable.com/cve/CVE-2026-94103 https://www.tenable.com/cve/CVE-2026-94103 Mon, 21 Sep 2026 02:16:53 GMT Medium Severity

Description

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/site_pagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94103

]]> https://www.tenable.com/cve/CVE-2026-94102 https://www.tenable.com/cve/CVE-2026-94102 Mon, 21 Sep 2026 02:16:53 GMT Medium Severity

Description

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The only sanitization is remove_xss(), an XSS keyword/entity scrubber. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94102

]]> https://www.tenable.com/cve/CVE-2026-94101 https://www.tenable.com/cve/CVE-2026-94101 Mon, 21 Sep 2026 02:16:53 GMT Critical Severity

Description

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlan_load_form_uci of the file /usr/bin/routerd. The manipulation of the argument wan_num leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94101

]]> https://www.tenable.com/cve/CVE-2026-94100 https://www.tenable.com/cve/CVE-2026-94100 Mon, 21 Sep 2026 01:16:30 GMT Critical Severity

Description

A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_config_set_vlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlan_wanX.ports can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94100

]]> https://www.tenable.com/cve/CVE-2026-94099 https://www.tenable.com/cve/CVE-2026-94099 Mon, 21 Sep 2026 01:16:29 GMT Critical Severity

Description

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERY_STRING results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94099

]]> https://www.tenable.com/cve/CVE-2026-94098 https://www.tenable.com/cve/CVE-2026-94098 Mon, 21 Sep 2026 01:16:29 GMT Critical Severity

Description

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERY_STRING leads to command injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94098

]]> https://www.tenable.com/cve/CVE-2026-94097 https://www.tenable.com/cve/CVE-2026-94097 Mon, 21 Sep 2026 00:16:59 GMT Critical Severity

Description

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94097

]]> https://www.tenable.com/cve/CVE-2026-94096 https://www.tenable.com/cve/CVE-2026-94096 Mon, 21 Sep 2026 00:16:59 GMT Critical Severity

Description

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94096

]]> https://www.tenable.com/cve/CVE-2026-94095 https://www.tenable.com/cve/CVE-2026-94095 Mon, 21 Sep 2026 00:16:59 GMT Critical Severity

Description

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Read more at https://www.tenable.com/cve/CVE-2026-94095

]]> https://www.tenable.com/cve/CVE-2026-94094 https://www.tenable.com/cve/CVE-2026-94094 Sun, 20 Sep 2026 23:17:03 GMT Medium Severity

Description

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. Fix suggestion's "streaming/size-limit" was never shipped - latest 2026.9.5 still buffers the whole file via readFile() (src/canvas/serve.runtime.ts:17,114), unlike the sibling WS path which caps at 64KB. The vendor was contacted early about this disclosure.

Read more at https://www.tenable.com/cve/CVE-2026-94094

]]> https://www.tenable.com/cve/CVE-2026-94093 https://www.tenable.com/cve/CVE-2026-94093 Sun, 20 Sep 2026 23:17:03 GMT Medium Severity

Description

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

Read more at https://www.tenable.com/cve/CVE-2026-94093

]]> https://www.tenable.com/cve/CVE-2026-94092 https://www.tenable.com/cve/CVE-2026-94092 Sun, 20 Sep 2026 23:17:03 GMT Medium Severity

Description

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94092

]]> https://www.tenable.com/cve/CVE-2026-94091 https://www.tenable.com/cve/CVE-2026-94091 Sun, 20 Sep 2026 23:17:02 GMT Medium Severity

Description

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Maintainer closed #3663 same-day with no comment, PR, or fix; repo's last push (2025-11-01) predates the report, so the unsafe pickle.load in SaveLoad.load remains unguarded at develop HEAD.

Read more at https://www.tenable.com/cve/CVE-2026-94091

]]> https://www.tenable.com/cve/CVE-2026-94090 https://www.tenable.com/cve/CVE-2026-94090 Sun, 20 Sep 2026 22:16:30 GMT Medium Severity

Description

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::_parse_debug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patch is identified as 3e299685759f4f767088871de58c5d07f98ee382. A patch should be applied to remediate this issue.

Read more at https://www.tenable.com/cve/CVE-2026-94090

]]> https://www.tenable.com/cve/CVE-2026-94089 https://www.tenable.com/cve/CVE-2026-94089 Sun, 20 Sep 2026 21:16:55 GMT Critical Severity

Description

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Read more at https://www.tenable.com/cve/CVE-2026-94089

]]> https://www.tenable.com/cve/CVE-2026-94051 https://www.tenable.com/cve/CVE-2026-94051 Sun, 20 Sep 2026 21:16:55 GMT Medium Severity

Description

A vulnerability was found in 0717376 cowork_bench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file local_servers/pdf-tools-mcp/pdf_tools_mcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument pdf_file_path results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94051

]]> https://www.tenable.com/cve/CVE-2026-94050 https://www.tenable.com/cve/CVE-2026-94050 Sun, 20 Sep 2026 21:16:55 GMT Medium Severity

Description

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.

Read more at https://www.tenable.com/cve/CVE-2026-94050

]]> https://www.tenable.com/cve/CVE-2026-94049 https://www.tenable.com/cve/CVE-2026-94049 Sun, 20 Sep 2026 20:16:54 GMT Medium Severity

Description

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function render_slides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94049

]]> https://www.tenable.com/cve/CVE-2026-94048 https://www.tenable.com/cve/CVE-2026-94048 Sun, 20 Sep 2026 20:16:54 GMT Medium Severity

Description

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument role_id results in improper privilege management. The attack can be executed remotely. The exploit is now public and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-94048

]]> https://www.tenable.com/cve/CVE-2026-94047 https://www.tenable.com/cve/CVE-2026-94047 Sun, 20 Sep 2026 20:16:53 GMT Medium Severity

Description

A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the function importTemplate of the file src/services/templateService.ts of the component Template Import Endpoint. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.33 is sufficient to resolve this issue. The identifier of the patch is 18a4467bc4ec6390b1f841d8a468a37e9922f837. It is advisable to upgrade the affected component.

Read more at https://www.tenable.com/cve/CVE-2026-94047

]]> https://www.tenable.com/cve/CVE-2026-94046 https://www.tenable.com/cve/CVE-2026-94046 Sun, 20 Sep 2026 19:17:13 GMT Medium Severity

Description

A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function get_file_snippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. isPathInsideProjectRoot only blocks filePath escaping the attacker-chosen projectRootPath; the root itself is untrusted client input - set projectRootPath=/etc, filePath=hosts and the guard passes. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94046

]]> https://www.tenable.com/cve/CVE-2026-94045 https://www.tenable.com/cve/CVE-2026-94045 Sun, 20 Sep 2026 19:17:13 GMT Medium Severity

Description

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. ImageIO.read() is a format-agnostic read - it returns non-null for a polyglot PNG| payload, which is exactly why the "image-only" guard is bypassable; the attacker-controlled suffix + /upload/** static mapping is what turns the upload into persisted XSS rather than a one-shot. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94045

]]> https://www.tenable.com/cve/CVE-2026-94044 https://www.tenable.com/cve/CVE-2026-94044 Sun, 20 Sep 2026 19:17:12 GMT Medium Severity

Description

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function create_file of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94044

]]> https://www.tenable.com/cve/CVE-2026-94043 https://www.tenable.com/cve/CVE-2026-94043 Sun, 20 Sep 2026 19:17:12 GMT Medium Severity

Description

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name: e323b01464355781b8b8d5dd695e05cbc00a62f2. To fix this issue, it is recommended to deploy a patch.

Read more at https://www.tenable.com/cve/CVE-2026-94043

]]> https://www.tenable.com/cve/CVE-2026-94042 https://www.tenable.com/cve/CVE-2026-94042 Sun, 20 Sep 2026 18:16:54 GMT Medium Severity

Description

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/add_table.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94042

]]> https://www.tenable.com/cve/CVE-2026-94041 https://www.tenable.com/cve/CVE-2026-94041 Sun, 20 Sep 2026 18:16:54 GMT Medium Severity

Description

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/add_menu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94041

]]> https://www.tenable.com/cve/CVE-2026-88857 https://www.tenable.com/cve/CVE-2026-88857 Sun, 20 Sep 2026 18:16:54 GMT Critical Severity

Description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

Read more at https://www.tenable.com/cve/CVE-2026-88857

]]> https://www.tenable.com/cve/CVE-2026-88856 https://www.tenable.com/cve/CVE-2026-88856 Sun, 20 Sep 2026 18:16:54 GMT Critical Severity

Description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shell_exec, and passthru.

Read more at https://www.tenable.com/cve/CVE-2026-88856

]]> https://www.tenable.com/cve/CVE-2026-88855 https://www.tenable.com/cve/CVE-2026-88855 Sun, 20 Sep 2026 18:16:54 GMT High Severity

Description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery() passes form data through a hand-rolled parser into Joomla’s Input object, then reads it back with the ARRAY/ STRING filter types, neither of which sanitises SQL content. Values from category_names[], catOrderIds, and image-ordering fields were concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user (a permission scoped to managing one gallery component, not administrator-wide trust) full read/write access to the database, including UNION-based extraction of #__users password hashes.

Read more at https://www.tenable.com/cve/CVE-2026-88855

]]> https://www.tenable.com/cve/CVE-2026-88854 https://www.tenable.com/cve/CVE-2026-88854 Sun, 20 Sep 2026 18:16:53 GMT Critical Severity

Description

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.

Read more at https://www.tenable.com/cve/CVE-2026-88854

]]> https://www.tenable.com/cve/CVE-2026-94040 https://www.tenable.com/cve/CVE-2026-94040 Sun, 20 Sep 2026 17:16:52 GMT Medium Severity

Description

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94040

]]> https://www.tenable.com/cve/CVE-2026-94039 https://www.tenable.com/cve/CVE-2026-94039 Sun, 20 Sep 2026 17:16:52 GMT Medium Severity

Description

A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94039

]]> https://www.tenable.com/cve/CVE-2026-94038 https://www.tenable.com/cve/CVE-2026-94038 Sun, 20 Sep 2026 17:16:52 GMT Medium Severity

Description

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue.

Read more at https://www.tenable.com/cve/CVE-2026-94038

]]> https://www.tenable.com/cve/CVE-2026-94037 https://www.tenable.com/cve/CVE-2026-94037 Sun, 20 Sep 2026 17:16:52 GMT Medium Severity

Description

A weakness has been identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405. This affects the function ControlFlowNode of the file main.py of the component analyze_csv_data MCP tool. This manipulation of the argument filename causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94037

]]> https://www.tenable.com/cve/CVE-2026-94036 https://www.tenable.com/cve/CVE-2026-94036 Sun, 20 Sep 2026 16:16:55 GMT High Severity

Description

A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results in improper access controls. The attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-94036

]]> https://www.tenable.com/cve/CVE-2026-94035 https://www.tenable.com/cve/CVE-2026-94035 Sun, 20 Sep 2026 16:16:55 GMT Medium Severity

Description

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drug_recommender/index.php. Executing a manipulation of the argument full name can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

Read more at https://www.tenable.com/cve/CVE-2026-94035

]]> https://www.tenable.com/cve/CVE-2026-94034 https://www.tenable.com/cve/CVE-2026-94034 Sun, 20 Sep 2026 15:16:30 GMT Medium Severity

Description

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.

Read more at https://www.tenable.com/cve/CVE-2026-94034

]]> https://www.tenable.com/cve/CVE-2026-94033 https://www.tenable.com/cve/CVE-2026-94033 Sun, 20 Sep 2026 15:16:30 GMT Medium Severity

Description

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/add_user of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-94033

]]> https://www.tenable.com/cve/CVE-2026-94032 https://www.tenable.com/cve/CVE-2026-94032 Sun, 20 Sep 2026 15:16:29 GMT Medium Severity

Description

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-94032

]]> https://www.tenable.com/cve/CVE-2026-94031 https://www.tenable.com/cve/CVE-2026-94031 Sun, 20 Sep 2026 14:17:00 GMT Medium Severity

Description

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function child_process.exec of the file src/auth/browser.ts of the component nexus_reauth MCP tool. The manipulation of the argument url results in command injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-94031

]]> https://www.tenable.com/cve/CVE-2026-94030 https://www.tenable.com/cve/CVE-2026-94030 Sun, 20 Sep 2026 14:17:00 GMT Low Severity

Description

A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.

Read more at https://www.tenable.com/cve/CVE-2026-94030

]]> https://www.tenable.com/cve/CVE-2026-94028 https://www.tenable.com/cve/CVE-2026-94028 Sun, 20 Sep 2026 13:17:46 GMT Medium Severity

Description

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 3.26.0 is able to address this issue. This patch is called fb221afa258c8dd2c4ac95b1996c33ef9db3f477. The affected component should be upgraded.

Read more at https://www.tenable.com/cve/CVE-2026-94028

]]> https://www.tenable.com/cve/CVE-2026-94016 https://www.tenable.com/cve/CVE-2026-94016 Sun, 20 Sep 2026 13:17:46 GMT Medium Severity

Description

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-94016

]]> https://www.tenable.com/cve/CVE-2026-94015 https://www.tenable.com/cve/CVE-2026-94015 Sun, 20 Sep 2026 13:17:46 GMT Medium Severity

Description

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.

Read more at https://www.tenable.com/cve/CVE-2026-94015

]]> https://www.tenable.com/cve/CVE-2026-92254 https://www.tenable.com/cve/CVE-2026-92254 Sun, 20 Sep 2026 13:17:46 GMT Medium Severity

Description

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and potentially disabling security products or destabilizing the operating system, via crafted IOCTL requests sent to the \Device\wsdk device.

Read more at https://www.tenable.com/cve/CVE-2026-92254

]]> https://www.tenable.com/cve/CVE-2026-92253 https://www.tenable.com/cve/CVE-2026-92253 Sun, 20 Sep 2026 13:17:46 GMT Medium Severity

Description

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file path and persuading an administrator to restore the file. This may enable modification of protected files or SYSTEM-level code execution through DLL hijacking.

Read more at https://www.tenable.com/cve/CVE-2026-92253

]]> https://www.tenable.com/cve/CVE-2026-92252 https://www.tenable.com/cve/CVE-2026-92252 Sun, 20 Sep 2026 13:17:46 GMT High Severity

Description

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. This may disable antivirus protection or enable privileged code execution if modified binaries are loaded by an elevated WatchDog process.

Read more at https://www.tenable.com/cve/CVE-2026-92252

]]> https://www.tenable.com/cve/CVE-2026-90817 https://www.tenable.com/cve/CVE-2026-90817 Sun, 20 Sep 2026 13:17:44 GMT Critical Severity

Description

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by supplying a crafted file-path/stream parameter during import handling. If successfully exploited, this could allow the attacker to remotely execute arbitrary code on the REDCap server. The attacker does not have to be authenticated in order to exploit this, but exploitation requires knowledge of a valid public survey hash. This vulnerability exists in REDCap 13.3.0 and higher.

Read more at https://www.tenable.com/cve/CVE-2026-90817

]]> https://www.tenable.com/cve/CVE-2026-94113 https://www.tenable.com/cve/CVE-2026-94113 Sun, 20 Sep 2026 12:17:07 GMT High Severity

Description

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to enforce doctype permissions. Authenticated attackers can call get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet endpoints to enumerate and retrieve billable time logs including project names, billing amounts, and work descriptions without proper authorization checks.

Read more at https://www.tenable.com/cve/CVE-2026-94113

]]> https://www.tenable.com/cve/CVE-2026-94112 https://www.tenable.com/cve/CVE-2026-94112 Sun, 20 Sep 2026 12:17:06 GMT High Severity

Description

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Read more at https://www.tenable.com/cve/CVE-2026-94112

]]> https://www.tenable.com/cve/CVE-2026-94111 https://www.tenable.com/cve/CVE-2026-94111 Sun, 20 Sep 2026 12:17:06 GMT Medium Severity

Description

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

Read more at https://www.tenable.com/cve/CVE-2026-94111

]]> https://www.tenable.com/cve/CVE-2026-94109 https://www.tenable.com/cve/CVE-2026-94109 Sun, 20 Sep 2026 12:17:06 GMT High Severity

Description

openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation due to an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions through collection summaries, dashboard portlets, or MIME templates to instantiate dangerous classes like freemarker.template.utility.Execute and invoke Runtime.exec for arbitrary command execution.

Read more at https://www.tenable.com/cve/CVE-2026-94109

]]> https://www.tenable.com/cve/CVE-2026-94108 https://www.tenable.com/cve/CVE-2026-94108 Sun, 20 Sep 2026 12:17:06 GMT High Severity

Description

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, or cause denial of service through entity expansion.

Read more at https://www.tenable.com/cve/CVE-2026-94108

]]> https://www.tenable.com/cve/CVE-2026-94107 https://www.tenable.com/cve/CVE-2026-94107 Sun, 20 Sep 2026 12:17:06 GMT Critical Severity

Description

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

Read more at https://www.tenable.com/cve/CVE-2026-94107

]]> https://www.tenable.com/cve/CVE-2026-94106 https://www.tenable.com/cve/CVE-2026-94106 Sun, 20 Sep 2026 12:17:06 GMT High Severity

Description

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

Read more at https://www.tenable.com/cve/CVE-2026-94106

]]> https://www.tenable.com/cve/CVE-2026-94105 https://www.tenable.com/cve/CVE-2026-94105 Sun, 20 Sep 2026 12:17:05 GMT Medium Severity

Description

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to rewrite the config_password setting to 0, disabling self-service password recovery until an administrator manually re-enables it.

Read more at https://www.tenable.com/cve/CVE-2026-94105

]]> https://www.tenable.com/cve/CVE-2026-94104 https://www.tenable.com/cve/CVE-2026-94104 Sun, 20 Sep 2026 12:17:05 GMT High Severity

Description

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Read more at https://www.tenable.com/cve/CVE-2026-94104

]]> https://www.tenable.com/cve/CVE-2026-94004 https://www.tenable.com/cve/CVE-2026-94004 Sun, 20 Sep 2026 12:17:05 GMT Medium Severity

Description

A vulnerability was found in DedeCMS up to 5.7.118. The affected element is an unknown function of the file plus/mytag_js.php. The manipulation of the argument aid results in code injection. The attack can be launched remotely. The exploit has been made public and could be used.

Read more at https://www.tenable.com/cve/CVE-2026-94004

]]> https://www.tenable.com/cve/CVE-2026-94003 https://www.tenable.com/cve/CVE-2026-94003 Sun, 20 Sep 2026 12:17:05 GMT Critical Severity

Description

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-94003

]]> https://www.tenable.com/cve/CVE-2026-93997 https://www.tenable.com/cve/CVE-2026-93997 Sun, 20 Sep 2026 12:17:05 GMT Medium Severity

Description

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/edit_symptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-93997

]]> https://www.tenable.com/cve/CVE-2026-93980 https://www.tenable.com/cve/CVE-2026-93980 Sun, 20 Sep 2026 11:16:58 GMT Medium Severity

Description

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-93980

]]> https://www.tenable.com/cve/CVE-2026-93979 https://www.tenable.com/cve/CVE-2026-93979 Sun, 20 Sep 2026 11:16:58 GMT Medium Severity

Description

A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-93979

]]> https://www.tenable.com/cve/CVE-2026-93978 https://www.tenable.com/cve/CVE-2026-93978 Sun, 20 Sep 2026 11:16:57 GMT Medium Severity

Description

A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Password leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Read more at https://www.tenable.com/cve/CVE-2026-93978

]]> https://www.tenable.com/cve/CVE-2026-93977 https://www.tenable.com/cve/CVE-2026-93977 Sun, 20 Sep 2026 11:16:57 GMT Medium Severity

Description

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Read more at https://www.tenable.com/cve/CVE-2026-93977

]]> https://www.tenable.com/cve/CVE-2026-93976 https://www.tenable.com/cve/CVE-2026-93976 Sun, 20 Sep 2026 10:16:53 GMT Medium Severity

Description

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

Read more at https://www.tenable.com/cve/CVE-2026-93976

]]> https://www.tenable.com/cve/CVE-2026-93975 https://www.tenable.com/cve/CVE-2026-93975 Sun, 20 Sep 2026 10:16:52 GMT Medium Severity

Description

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-93975

]]> https://www.tenable.com/cve/CVE-2026-86555 https://www.tenable.com/cve/CVE-2026-86555 Sun, 20 Sep 2026 10:16:52 GMT Medium Severity

Description

The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. Once the key is obtained, the server information can be decrypted, thus exposing it.

Read more at https://www.tenable.com/cve/CVE-2026-86555

]]> https://www.tenable.com/cve/CVE-2026-93974 https://www.tenable.com/cve/CVE-2026-93974 Sun, 20 Sep 2026 09:16:39 GMT Medium Severity

Description

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-93974

]]> https://www.tenable.com/cve/CVE-2026-93973 https://www.tenable.com/cve/CVE-2026-93973 Sun, 20 Sep 2026 09:16:39 GMT Medium Severity

Description

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-93973

]]> https://www.tenable.com/cve/CVE-2026-93972 https://www.tenable.com/cve/CVE-2026-93972 Sun, 20 Sep 2026 08:16:51 GMT Medium Severity

Description

A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/course/btn_functions.php. Such manipulation of the argument courseID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-93972

]]> https://www.tenable.com/cve/CVE-2026-93971 https://www.tenable.com/cve/CVE-2026-93971 Sun, 20 Sep 2026 08:16:51 GMT Medium Severity

Description

A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes information disclosure. It is possible to initiate the attack remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93971

]]> https://www.tenable.com/cve/CVE-2026-93970 https://www.tenable.com/cve/CVE-2026-93970 Sun, 20 Sep 2026 08:16:51 GMT Medium Severity

Description

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is advised to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93970

]]> https://www.tenable.com/cve/CVE-2026-86554 https://www.tenable.com/cve/CVE-2026-86554 Sun, 20 Sep 2026 08:16:50 GMT Medium Severity

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

Read more at https://www.tenable.com/cve/CVE-2026-86554

]]> https://www.tenable.com/cve/CVE-2026-93969 https://www.tenable.com/cve/CVE-2026-93969 Sun, 20 Sep 2026 07:16:52 GMT Medium Severity

Description

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is recommended to apply a patch to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93969

]]> https://www.tenable.com/cve/CVE-2026-93968 https://www.tenable.com/cve/CVE-2026-93968 Sun, 20 Sep 2026 07:16:52 GMT Medium Severity

Description

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93968

]]> https://www.tenable.com/cve/CVE-2026-93967 https://www.tenable.com/cve/CVE-2026-93967 Sun, 20 Sep 2026 07:16:51 GMT Medium Severity

Description

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attack is possible. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93967

]]> https://www.tenable.com/cve/CVE-2026-93966 https://www.tenable.com/cve/CVE-2026-93966 Sun, 20 Sep 2026 07:16:51 GMT Medium Severity

Description

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command leads to command injection. The attack may be launched remotely. The name of the patch is 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is advisable to implement a patch to correct this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93966

]]> https://www.tenable.com/cve/CVE-2026-92965 https://www.tenable.com/cve/CVE-2026-92965 Sun, 20 Sep 2026 07:16:51 GMT Low Severity

Description

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.

Read more at https://www.tenable.com/cve/CVE-2026-92965

]]> https://www.tenable.com/cve/CVE-2026-92541 https://www.tenable.com/cve/CVE-2026-92541 Sun, 20 Sep 2026 07:16:51 GMT High Severity

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.

Read more at https://www.tenable.com/cve/CVE-2026-92541

]]> https://www.tenable.com/cve/CVE-2026-92540 https://www.tenable.com/cve/CVE-2026-92540 Sun, 20 Sep 2026 07:16:51 GMT High Severity

Description

The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.

Read more at https://www.tenable.com/cve/CVE-2026-92540

]]> https://www.tenable.com/cve/CVE-2026-92423 https://www.tenable.com/cve/CVE-2026-92423 Sun, 20 Sep 2026 07:16:51 GMT Low Severity

Description

The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.

Read more at https://www.tenable.com/cve/CVE-2026-92423

]]> https://www.tenable.com/cve/CVE-2026-92422 https://www.tenable.com/cve/CVE-2026-92422 Sun, 20 Sep 2026 07:16:51 GMT Medium Severity

Description

The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.

Read more at https://www.tenable.com/cve/CVE-2026-92422

]]> https://www.tenable.com/cve/CVE-2026-92410 https://www.tenable.com/cve/CVE-2026-92410 Sun, 20 Sep 2026 07:16:50 GMT Medium Severity

Description

The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.

Read more at https://www.tenable.com/cve/CVE-2026-92410

]]> https://www.tenable.com/cve/CVE-2026-87840 https://www.tenable.com/cve/CVE-2026-87840 Sun, 20 Sep 2026 07:16:50 GMT Medium Severity

Description

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.

Read more at https://www.tenable.com/cve/CVE-2026-87840

]]> https://www.tenable.com/cve/CVE-2026-87839 https://www.tenable.com/cve/CVE-2026-87839 Sun, 20 Sep 2026 07:16:50 GMT High Severity

Description

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Read more at https://www.tenable.com/cve/CVE-2026-87839

]]> https://www.tenable.com/cve/CVE-2026-87068 https://www.tenable.com/cve/CVE-2026-87068 Sun, 20 Sep 2026 07:16:50 GMT Medium Severity

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.

Read more at https://www.tenable.com/cve/CVE-2026-87068

]]> https://www.tenable.com/cve/CVE-2026-87067 https://www.tenable.com/cve/CVE-2026-87067 Sun, 20 Sep 2026 07:16:50 GMT High Severity

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.

Read more at https://www.tenable.com/cve/CVE-2026-87067

]]> https://www.tenable.com/cve/CVE-2026-85017 https://www.tenable.com/cve/CVE-2026-85017 Sun, 20 Sep 2026 07:16:50 GMT High Severity

Description

The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.

Read more at https://www.tenable.com/cve/CVE-2026-85017

]]> https://www.tenable.com/cve/CVE-2026-84223 https://www.tenable.com/cve/CVE-2026-84223 Sun, 20 Sep 2026 07:16:50 GMT Medium Severity

Description

The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.

Read more at https://www.tenable.com/cve/CVE-2026-84223

]]> https://www.tenable.com/cve/CVE-2026-82842 https://www.tenable.com/cve/CVE-2026-82842 Sun, 20 Sep 2026 07:16:50 GMT High Severity

Description

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.

Read more at https://www.tenable.com/cve/CVE-2026-82842

]]> https://www.tenable.com/cve/CVE-2026-81654 https://www.tenable.com/cve/CVE-2026-81654 Sun, 20 Sep 2026 07:16:49 GMT Low Severity

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.

Read more at https://www.tenable.com/cve/CVE-2026-81654

]]> https://www.tenable.com/cve/CVE-2026-81653 https://www.tenable.com/cve/CVE-2026-81653 Sun, 20 Sep 2026 07:16:49 GMT Medium Severity

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.

Read more at https://www.tenable.com/cve/CVE-2026-81653

]]> https://www.tenable.com/cve/CVE-2026-81652 https://www.tenable.com/cve/CVE-2026-81652 Sun, 20 Sep 2026 07:16:49 GMT Low Severity

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated read path reserves to administrators.

Read more at https://www.tenable.com/cve/CVE-2026-81652

]]> https://www.tenable.com/cve/CVE-2026-81651 https://www.tenable.com/cve/CVE-2026-81651 Sun, 20 Sep 2026 07:16:49 GMT Low Severity

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.

Read more at https://www.tenable.com/cve/CVE-2026-81651

]]> https://www.tenable.com/cve/CVE-2026-81650 https://www.tenable.com/cve/CVE-2026-81650 Sun, 20 Sep 2026 07:16:49 GMT High Severity

Description

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.

Read more at https://www.tenable.com/cve/CVE-2026-81650

]]> https://www.tenable.com/cve/CVE-2026-16542 https://www.tenable.com/cve/CVE-2026-16542 Sun, 20 Sep 2026 07:16:49 GMT Medium Severity

Description

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.

Read more at https://www.tenable.com/cve/CVE-2026-16542

]]> https://www.tenable.com/cve/CVE-2026-14844 https://www.tenable.com/cve/CVE-2026-14844 Sun, 20 Sep 2026 07:16:48 GMT Medium Severity

Description

The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor, for example with a shortcode-restriction Master Slider WordPress plugin through 3.11.2, which prevents the attack without removing the Master Slider WordPress plugin through 3.11.2.

Read more at https://www.tenable.com/cve/CVE-2026-14844

]]> https://www.tenable.com/cve/CVE-2026-93965 https://www.tenable.com/cve/CVE-2026-93965 Sun, 20 Sep 2026 06:16:50 GMT Medium Severity

Description

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. The attack may be initiated remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. To fix this issue, it is recommended to deploy a patch. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93965

]]> https://www.tenable.com/cve/CVE-2026-93964 https://www.tenable.com/cve/CVE-2026-93964 Sun, 20 Sep 2026 06:16:50 GMT Medium Severity

Description

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be used. Endpoint only processes and echoes back the certificate the caller submits (no stored data leaked); the real risk is unauthenticated openssl processing of attacker input. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-93964

]]> https://www.tenable.com/cve/CVE-2026-93963 https://www.tenable.com/cve/CVE-2026-93963 Sun, 20 Sep 2026 06:16:49 GMT Medium Severity

Description

A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Read more at https://www.tenable.com/cve/CVE-2026-93963

]]> https://www.tenable.com/cve/CVE-2026-93962 https://www.tenable.com/cve/CVE-2026-93962 Sun, 20 Sep 2026 05:16:29 GMT Medium Severity

Description

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component.

Read more at https://www.tenable.com/cve/CVE-2026-93962

]]> https://www.tenable.com/cve/CVE-2026-93961 https://www.tenable.com/cve/CVE-2026-93961 Sun, 20 Sep 2026 05:16:28 GMT Medium Severity

Description

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in improper authorization. It is possible to initiate the attack remotely. The project was informed of the problem early through an issue report but has not responded yet.

Read more at https://www.tenable.com/cve/CVE-2026-93961

]]> https://www.tenable.com/cve/CVE-2026-93960 https://www.tenable.com/cve/CVE-2026-93960 Sun, 20 Sep 2026 04:17:55 GMT Medium Severity

Description

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised.

Read more at https://www.tenable.com/cve/CVE-2026-93960

]]> https://www.tenable.com/cve/CVE-2026-86553 https://www.tenable.com/cve/CVE-2026-86553 Sun, 20 Sep 2026 04:17:06 GMT High Severity

Description

SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired SmartLife application authentication parameters, an attacker can directly call the backend interface /account/verify.serv to obtain the real account ID corresponding to a registered email address. By spoofing the application authentication information together with the target account ID, the attacker can reset the password of the target account.

Read more at https://www.tenable.com/cve/CVE-2026-86553

]]> https://www.tenable.com/cve/CVE-2026-86552 https://www.tenable.com/cve/CVE-2026-86552 Sun, 20 Sep 2026 04:17:02 GMT Medium Severity

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface /account/person/signup.serv. Email ownership is not verified prior to registration.

Read more at https://www.tenable.com/cve/CVE-2026-86552

]]> https://www.tenable.com/cve/CVE-2026-93959 https://www.tenable.com/cve/CVE-2026-93959 Sun, 20 Sep 2026 03:16:31 GMT Medium Severity

Description

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/course/btn_functions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Read more at https://www.tenable.com/cve/CVE-2026-93959

]]> https://www.tenable.com/cve/CVE-2026-94084 https://www.tenable.com/cve/CVE-2026-94084 Sun, 20 Sep 2026 02:16:53 GMT Critical Severity

Description

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

Read more at https://www.tenable.com/cve/CVE-2026-94084

]]> https://www.tenable.com/cve/CVE-2026-94083 https://www.tenable.com/cve/CVE-2026-94083 Sun, 20 Sep 2026 02:16:53 GMT Critical Severity

Description

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.

Read more at https://www.tenable.com/cve/CVE-2026-94083

]]> https://www.tenable.com/cve/CVE-2026-93958 https://www.tenable.com/cve/CVE-2026-93958 Sun, 20 Sep 2026 02:16:53 GMT Critical Severity

Description

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.

Read more at https://www.tenable.com/cve/CVE-2026-93958

]]> https://www.tenable.com/cve/CVE-2026-93957 https://www.tenable.com/cve/CVE-2026-93957 Sun, 20 Sep 2026 02:16:52 GMT Medium Severity

Description

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93957

]]> https://www.tenable.com/cve/CVE-2026-86551 https://www.tenable.com/cve/CVE-2026-86551 Sun, 20 Sep 2026 02:16:51 GMT Low Severity

Description

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

Read more at https://www.tenable.com/cve/CVE-2026-86551

]]> https://www.tenable.com/cve/CVE-2026-94057 https://www.tenable.com/cve/CVE-2026-94057 Sat, 19 Sep 2026 23:17:11 GMT Medium Severity

Description

Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.

Read more at https://www.tenable.com/cve/CVE-2026-94057

]]> https://www.tenable.com/cve/CVE-2026-94056 https://www.tenable.com/cve/CVE-2026-94056 Sat, 19 Sep 2026 23:17:11 GMT High Severity

Description

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

Read more at https://www.tenable.com/cve/CVE-2026-94056

]]> https://www.tenable.com/cve/CVE-2026-94055 https://www.tenable.com/cve/CVE-2026-94055 Sat, 19 Sep 2026 23:17:10 GMT Low Severity

Description

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

Read more at https://www.tenable.com/cve/CVE-2026-94055

]]> https://www.tenable.com/cve/CVE-2026-94054 https://www.tenable.com/cve/CVE-2026-94054 Sat, 19 Sep 2026 23:17:10 GMT High Severity

Description

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

Read more at https://www.tenable.com/cve/CVE-2026-94054

]]> https://www.tenable.com/cve/CVE-2026-93993 https://www.tenable.com/cve/CVE-2026-93993 Sat, 19 Sep 2026 23:17:10 GMT High Severity

Description

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary shell commands with the privileges of the user running Vibe.

Read more at https://www.tenable.com/cve/CVE-2026-93993

]]> https://www.tenable.com/cve/CVE-2026-93992 https://www.tenable.com/cve/CVE-2026-93992 Sat, 19 Sep 2026 23:17:10 GMT High Severity

Description

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory traversal sequences that bypass validation, enabling file write operations when users download and extract archives with AutoExtract enabled.

Read more at https://www.tenable.com/cve/CVE-2026-93992

]]> https://www.tenable.com/cve/CVE-2026-93991 https://www.tenable.com/cve/CVE-2026-93991 Sat, 19 Sep 2026 23:17:10 GMT High Severity

Description

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace-scoped list permissions can use a negated namespace field selector to retrieve archived workflows from all other namespaces, exposing spec arguments, parameter values, and annotations.

Read more at https://www.tenable.com/cve/CVE-2026-93991

]]> https://www.tenable.com/cve/CVE-2026-93990 https://www.tenable.com/cve/CVE-2026-93990 Sat, 19 Sep 2026 23:17:10 GMT High Severity

Description

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Read more at https://www.tenable.com/cve/CVE-2026-93990

]]> https://www.tenable.com/cve/CVE-2026-93989 https://www.tenable.com/cve/CVE-2026-93989 Sat, 19 Sep 2026 23:17:10 GMT Low Severity

Description

vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, causing different in-flight HTTP requests to return incorrect tokens.

Read more at https://www.tenable.com/cve/CVE-2026-93989

]]> https://www.tenable.com/cve/CVE-2026-93988 https://www.tenable.com/cve/CVE-2026-93988 Sat, 19 Sep 2026 23:17:09 GMT High Severity

Description

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive files including database credentials and configuration data.

Read more at https://www.tenable.com/cve/CVE-2026-93988

]]> https://www.tenable.com/cve/CVE-2026-93956 https://www.tenable.com/cve/CVE-2026-93956 Sat, 19 Sep 2026 23:17:09 GMT Medium Severity

Description

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Read more at https://www.tenable.com/cve/CVE-2026-93956

]]> https://www.tenable.com/cve/CVE-2026-93955 https://www.tenable.com/cve/CVE-2026-93955 Sat, 19 Sep 2026 23:17:09 GMT Medium Severity

Description

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there.

Read more at https://www.tenable.com/cve/CVE-2026-93955

]]> https://www.tenable.com/cve/CVE-2026-89155 https://www.tenable.com/cve/CVE-2026-89155 Sat, 19 Sep 2026 23:17:08 GMT Severity Not Scored

Description

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Read more at https://www.tenable.com/cve/CVE-2026-89155

]]> https://www.tenable.com/cve/CVE-2026-93954 https://www.tenable.com/cve/CVE-2026-93954 Sat, 19 Sep 2026 22:16:28 GMT Medium Severity

Description

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads to incorrect authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 2b66ca6df8110f6b512e030b54c16b9fbe318f17. Applying a patch is advised to resolve this issue. PR #2558, merged as 53abc8b, moved the OIDC secret into a dedicated setting, but did not by itself restrict GET /api/v1/settings.

Read more at https://www.tenable.com/cve/CVE-2026-93954

]]> https://www.tenable.com/cve/CVE-2026-82672 https://www.tenable.com/cve/CVE-2026-82672 Sat, 19 Sep 2026 17:16:35 GMT Medium Severity

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.

Read more at https://www.tenable.com/cve/CVE-2026-82672

]]> https://www.tenable.com/cve/CVE-2026-82560 https://www.tenable.com/cve/CVE-2026-82560 Sat, 19 Sep 2026 16:16:32 GMT High Severity

Description

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass. Formatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted.

Read more at https://www.tenable.com/cve/CVE-2026-82560

]]> https://www.tenable.com/cve/CVE-2026-94001 https://www.tenable.com/cve/CVE-2026-94001 Sat, 19 Sep 2026 15:17:08 GMT Medium Severity

Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.

Read more at https://www.tenable.com/cve/CVE-2026-94001

]]> https://www.tenable.com/cve/CVE-2026-94000 https://www.tenable.com/cve/CVE-2026-94000 Sat, 19 Sep 2026 15:17:08 GMT Medium Severity

Description

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm.

Read more at https://www.tenable.com/cve/CVE-2026-94000

]]> https://www.tenable.com/cve/CVE-2026-93999 https://www.tenable.com/cve/CVE-2026-93999 Sat, 19 Sep 2026 15:17:08 GMT Medium Severity

Description

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation.

Read more at https://www.tenable.com/cve/CVE-2026-93999

]]> https://www.tenable.com/cve/CVE-2026-93987 https://www.tenable.com/cve/CVE-2026-93987 Sat, 19 Sep 2026 12:16:42 GMT Medium Severity

Description

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name` field of a Docker VolumeDriver.Create request without verifying that the result stays within drv.root (default /var/lib/docker-volumes/rclone), and checkMountpoint() then creates that directory with file.MkdirAll before mounting. A volume name containing enough `..` components (e.g. "../../../../../../etc") therefore resolves outside the base directory, allowing anyone able to submit a VolumeDriver.Create request to the plugin socket — normally the Docker daemon, or a workload that can request named volumes in a multi-tenant orchestration setup — to make the privileged rclone plugin process create a directory and mount a remote filesystem specified in the same request at an arbitrary host path, shadowing or disrupting system directories. The advisory notes Volume.restoreState() had the same missing validation when reloading persisted volume state. Fixed in 1.75.1.

Read more at https://www.tenable.com/cve/CVE-2026-93987

]]> https://www.tenable.com/cve/CVE-2026-93986 https://www.tenable.com/cve/CVE-2026-93986 Sat, 19 Sep 2026 12:16:42 GMT Low Severity

Description

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the destination root, though downstream protections in the local backend currently block actual file escape.

Read more at https://www.tenable.com/cve/CVE-2026-93986

]]> https://www.tenable.com/cve/CVE-2026-93985 https://www.tenable.com/cve/CVE-2026-93985 Sat, 19 Sep 2026 12:16:41 GMT Critical Severity

Description

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

Read more at https://www.tenable.com/cve/CVE-2026-93985

]]> https://www.tenable.com/cve/CVE-2026-93984 https://www.tenable.com/cve/CVE-2026-93984 Sat, 19 Sep 2026 12:16:41 GMT Medium Severity

Description

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

Read more at https://www.tenable.com/cve/CVE-2026-93984

]]> https://www.tenable.com/cve/CVE-2026-93983 https://www.tenable.com/cve/CVE-2026-93983 Sat, 19 Sep 2026 12:16:41 GMT Medium Severity

Description

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

Read more at https://www.tenable.com/cve/CVE-2026-93983

]]> https://www.tenable.com/cve/CVE-2026-93982 https://www.tenable.com/cve/CVE-2026-93982 Sat, 19 Sep 2026 12:16:41 GMT Medium Severity

Description

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.

Read more at https://www.tenable.com/cve/CVE-2026-93982

]]> https://www.tenable.com/cve/CVE-2026-93981 https://www.tenable.com/cve/CVE-2026-93981 Sat, 19 Sep 2026 12:16:41 GMT Low Severity

Description

hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.

Read more at https://www.tenable.com/cve/CVE-2026-93981

]]> https://www.tenable.com/cve/CVE-2026-78030 https://www.tenable.com/cve/CVE-2026-78030 Sat, 19 Sep 2026 11:16:37 GMT Critical Severity

Description

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn = "dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm" my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix.

Read more at https://www.tenable.com/cve/CVE-2026-78030

]]> https://www.tenable.com/cve/CVE-2026-9858 https://www.tenable.com/cve/CVE-2026-9858 Sat, 19 Sep 2026 09:16:35 GMT Medium Severity

Description

The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging to any customer and to modify the shipment status / shipped quantities of any order, which can also trigger order status transitions via the wxp_order_status action.

Read more at https://www.tenable.com/cve/CVE-2026-9858

]]> https://www.tenable.com/cve/CVE-2026-9766 https://www.tenable.com/cve/CVE-2026-9766 Sat, 19 Sep 2026 09:16:35 GMT Medium Severity

Description

The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary WooCommerce product metadata, including Empik logistic class (_empik_logistic_klass), product state (_empik_product_state, _empik_product_state_all_variants), and Empik export and offer flags on any product in the store.

Read more at https://www.tenable.com/cve/CVE-2026-9766

]]> https://www.tenable.com/cve/CVE-2026-9613 https://www.tenable.com/cve/CVE-2026-9613 Sat, 19 Sep 2026 09:16:35 GMT Medium Severity

Description

The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails to customers.

Read more at https://www.tenable.com/cve/CVE-2026-9613

]]> https://www.tenable.com/cve/CVE-2026-93742 https://www.tenable.com/cve/CVE-2026-93742 Sat, 19 Sep 2026 09:16:34 GMT Critical Severity

Description

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-93742

]]> https://www.tenable.com/cve/CVE-2026-9289 https://www.tenable.com/cve/CVE-2026-9289 Sat, 19 Sep 2026 09:16:34 GMT Medium Severity

Description

The WordLift – AI powered SEO – Schema plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.54.10 via the JSON-LD REST API endpoints. This is due to the plugin registering the /wordlift/v1/jsonld/ routes (jsonld/{id}, jsonld/http/{item_id}, jsonld/post-meta/{meta_key}, jsonld/meta/{meta_key}, and jsonld/{post_type}/{post_name}) with a permission_callback of '__return_true' and the downstream converter retrieving the post via get_post() without verifying the post status or the requesting user's capabilities. This makes it possible for unauthenticated attackers to read the title, content/description, author, publication and modification dates, word count, comment count, and other metadata of private, draft, and pending posts by enumerating post IDs, bypassing WordPress core access controls.

Read more at https://www.tenable.com/cve/CVE-2026-9289

]]> https://www.tenable.com/cve/CVE-2026-8354 https://www.tenable.com/cve/CVE-2026-8354 Sat, 19 Sep 2026 09:16:34 GMT Medium Severity

Description

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pop_tag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Read more at https://www.tenable.com/cve/CVE-2026-8354

]]> https://www.tenable.com/cve/CVE-2026-76579 https://www.tenable.com/cve/CVE-2026-76579 Sat, 19 Sep 2026 09:16:34 GMT Medium Severity

Description

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the attacker supply a validly signed 'esi' value in the GET query string while submitting a separate attacker-controlled 'esi' payload as a POST body field, relying on PHP's default $_REQUEST merge order to have the POST value take precedence at the point of execution.

Read more at https://www.tenable.com/cve/CVE-2026-76579

]]> https://www.tenable.com/cve/CVE-2026-5410 https://www.tenable.com/cve/CVE-2026-5410 Sat, 19 Sep 2026 09:16:34 GMT Medium Severity

Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and including, 4.5.13 This is due to insufficient input sanitization and output escaping. In the user_meta_save() function scalar values bypass the sanitization logic that only processes arrays, allowing the spinner field value to be stored in user meta without proper sanitization. Later, at line 56 of class-redux-spinner.php in the render() function, this value is rendered in an unquoted HTML attribute without escaping via '$data_string .= ' data-val=' . $this->value;'. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Read more at https://www.tenable.com/cve/CVE-2026-5410

]]> https://www.tenable.com/cve/CVE-2026-1256 https://www.tenable.com/cve/CVE-2026-1256 Sat, 19 Sep 2026 09:16:34 GMT Medium Severity

Description

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

Read more at https://www.tenable.com/cve/CVE-2026-1256

]]> https://www.tenable.com/cve/CVE-2026-1255 https://www.tenable.com/cve/CVE-2026-1255 Sat, 19 Sep 2026 09:16:34 GMT High Severity

Description

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.

Read more at https://www.tenable.com/cve/CVE-2026-1255

]]> https://www.tenable.com/cve/CVE-2026-18346 https://www.tenable.com/cve/CVE-2026-18346 Sat, 19 Sep 2026 09:16:33 GMT Medium Severity

Description

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.

Read more at https://www.tenable.com/cve/CVE-2026-18346

]]> https://www.tenable.com/cve/CVE-2026-9855 https://www.tenable.com/cve/CVE-2026-9855 Sat, 19 Sep 2026 08:16:55 GMT Medium Severity

Description

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The capability check via current_user_can('edit_post', $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink, and a valid nonce — which is also required — can be legitimately obtained by any Contributor-level user from the post edit screen.

Read more at https://www.tenable.com/cve/CVE-2026-9855

]]> https://www.tenable.com/cve/CVE-2026-9832 https://www.tenable.com/cve/CVE-2026-9832 Sat, 19 Sep 2026 08:16:55 GMT Medium Severity

Description

The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\Stripe\Webhook::constructEvent()` is enforced and forged requests are rejected.

Read more at https://www.tenable.com/cve/CVE-2026-9832

]]> https://www.tenable.com/cve/CVE-2026-9615 https://www.tenable.com/cve/CVE-2026-9615 Sat, 19 Sep 2026 08:16:55 GMT Medium Severity

Description

The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_fleximp() and license_deactivate_fleximp() functions, hooked to the wp_ajax_license_activate_fleximp and wp_ajax_license_deactivate_fleximp AJAX actions, lacking both a capability check (current_user_can()) and nonce verification (the client-side script sends a 'wpnonce' value but the handlers never validate it). This makes it possible for authenticated attackers, with subscriber-level access and above, to activate an arbitrary/fraudulent license key (persisting it via update_option('fleximp_is_premium') and toggling validation, suspension, and bundle status options) or deactivate the site's legitimate license (deleting the stored key and setting fleximp_validation_status to false), thereby disrupting the plugin's premium functionality.

Read more at https://www.tenable.com/cve/CVE-2026-9615

]]> https://www.tenable.com/cve/CVE-2026-9232 https://www.tenable.com/cve/CVE-2026-9232 Sat, 19 Sep 2026 08:16:55 GMT Medium Severity

Description

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

Read more at https://www.tenable.com/cve/CVE-2026-9232

]]> https://www.tenable.com/cve/CVE-2026-87917 https://www.tenable.com/cve/CVE-2026-87917 Sat, 19 Sep 2026 08:16:54 GMT Medium Severity

Description

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Read more at https://www.tenable.com/cve/CVE-2026-87917

]]> https://www.tenable.com/cve/CVE-2026-85658 https://www.tenable.com/cve/CVE-2026-85658 Sat, 19 Sep 2026 08:16:54 GMT High Severity

Description

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

Read more at https://www.tenable.com/cve/CVE-2026-85658

]]> https://www.tenable.com/cve/CVE-2026-75959 https://www.tenable.com/cve/CVE-2026-75959 Sat, 19 Sep 2026 08:16:54 GMT Medium Severity

Description

The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Read more at https://www.tenable.com/cve/CVE-2026-75959

]]> https://www.tenable.com/cve/CVE-2026-7527 https://www.tenable.com/cve/CVE-2026-7527 Sat, 19 Sep 2026 08:16:54 GMT Medium Severity

Description

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 7.0.02. This is due to the plugin not properly validating user input. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into clicking on a specially crafted link. Exploitation requires tricking a logged-in user into clicking a crafted logout URL; the victim is fully logged out via wp_logout() before the malicious redirect is issued, making the logout irreversible as part of the attack chain.

Read more at https://www.tenable.com/cve/CVE-2026-7527

]]> https://www.tenable.com/cve/CVE-2026-6295 https://www.tenable.com/cve/CVE-2026-6295 Sat, 19 Sep 2026 08:16:54 GMT Medium Severity

Description

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.

Read more at https://www.tenable.com/cve/CVE-2026-6295

]]> https://www.tenable.com/cve/CVE-2026-5400 https://www.tenable.com/cve/CVE-2026-5400 Sat, 19 Sep 2026 08:16:54 GMT Medium Severity

Description

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media field filter values in versions up to, and including, 4.5.13 This is due to insufficient input sanitization of nested array values in the user_meta_save() function and unsafe output of filter CSS values in the render() function without proper escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Read more at https://www.tenable.com/cve/CVE-2026-5400

]]> https://www.tenable.com/cve/CVE-2026-4792 https://www.tenable.com/cve/CVE-2026-4792 Sat, 19 Sep 2026 08:16:54 GMT Medium Severity

Description

The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and authorization checks on the settings export functionality (download_settings function) which is registered on the plugins_loaded hook and explicitly allows execution on non-admin (public) pages. The function exports all plugin configuration settings including the protection_password field, which is stored in plaintext. This makes it possible for unauthenticated attackers to retrieve the PDF protection password by accessing the /?export-meeting-list=1 endpoint.

Read more at https://www.tenable.com/cve/CVE-2026-4792

]]> https://www.tenable.com/cve/CVE-2026-4327 https://www.tenable.com/cve/CVE-2026-4327 Sat, 19 Sep 2026 08:16:53 GMT High Severity

Description

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.

Read more at https://www.tenable.com/cve/CVE-2026-4327

]]> https://www.tenable.com/cve/CVE-2026-2422 https://www.tenable.com/cve/CVE-2026-2422 Sat, 19 Sep 2026 08:16:53 GMT Medium Severity

Description

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at save time, since the encoded string contains no harmful HTML characters.

Read more at https://www.tenable.com/cve/CVE-2026-2422

]]> https://www.tenable.com/cve/CVE-2026-2278 https://www.tenable.com/cve/CVE-2026-2278 Sat, 19 Sep 2026 08:16:53 GMT Medium Severity

Description

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all theme customizer settings to their defaults.

Read more at https://www.tenable.com/cve/CVE-2026-2278

]]> https://www.tenable.com/cve/CVE-2026-1984 https://www.tenable.com/cve/CVE-2026-1984 Sat, 19 Sep 2026 08:16:53 GMT Medium Severity

Description

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.

Read more at https://www.tenable.com/cve/CVE-2026-1984

]]> https://www.tenable.com/cve/CVE-2026-1641 https://www.tenable.com/cve/CVE-2026-1641 Sat, 19 Sep 2026 08:16:53 GMT Medium Severity

Description

The Wow Elements Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.11.2. This is due to the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get function without adequate validation or sanitization of the URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Read more at https://www.tenable.com/cve/CVE-2026-1641

]]> https://www.tenable.com/cve/CVE-2026-15947 https://www.tenable.com/cve/CVE-2026-15947 Sat, 19 Sep 2026 08:16:53 GMT Medium Severity

Description

The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.

Read more at https://www.tenable.com/cve/CVE-2026-15947

]]> https://www.tenable.com/cve/CVE-2026-1242 https://www.tenable.com/cve/CVE-2026-1242 Sat, 19 Sep 2026 08:16:53 GMT Medium Severity

Description

The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.

Read more at https://www.tenable.com/cve/CVE-2026-1242

]]> https://www.tenable.com/cve/CVE-2026-15946 https://www.tenable.com/cve/CVE-2026-15946 Sat, 19 Sep 2026 08:16:52 GMT Medium Severity

Description

The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.

Read more at https://www.tenable.com/cve/CVE-2026-15946

]]> https://www.tenable.com/cve/CVE-2026-15664 https://www.tenable.com/cve/CVE-2026-15664 Sat, 19 Sep 2026 08:16:52 GMT High Severity

Description

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes in the context of the WordPress admin results view, making administrators the primary target when reviewing submitted form entries.

Read more at https://www.tenable.com/cve/CVE-2026-15664

]]> https://www.tenable.com/cve/CVE-2026-15463 https://www.tenable.com/cve/CVE-2026-15463 Sat, 19 Sep 2026 08:16:52 GMT Medium Severity

Description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.

Read more at https://www.tenable.com/cve/CVE-2026-15463

]]> https://www.tenable.com/cve/CVE-2026-15098 https://www.tenable.com/cve/CVE-2026-15098 Sat, 19 Sep 2026 08:16:52 GMT Medium Severity

Description

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a byte sequence in the attribute value to break out of the JSON script context. Because WordPress's shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the breakout tag as \x3c/script\x3e\x3cscript\x3e…\x3c/script\x3e, which survives the wp_kses_post save-time filter applied to Contributor content (the escape bytes are safe text characters, not HTML tags) and is decoded to real angle brackets at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page.

Read more at https://www.tenable.com/cve/CVE-2026-15098

]]> https://www.tenable.com/cve/CVE-2026-13770 https://www.tenable.com/cve/CVE-2026-13770 Sat, 19 Sep 2026 08:16:52 GMT Medium Severity

Description

The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

Read more at https://www.tenable.com/cve/CVE-2026-13770

]]> https://www.tenable.com/cve/CVE-2026-13200 https://www.tenable.com/cve/CVE-2026-13200 Sat, 19 Sep 2026 08:16:52 GMT Medium Severity

Description

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.

Read more at https://www.tenable.com/cve/CVE-2026-13200

]]> https://www.tenable.com/cve/CVE-2026-13191 https://www.tenable.com/cve/CVE-2026-13191 Sat, 19 Sep 2026 08:16:52 GMT Medium Severity

Description

The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.

Read more at https://www.tenable.com/cve/CVE-2026-13191

]]> https://www.tenable.com/cve/CVE-2026-12402 https://www.tenable.com/cve/CVE-2026-12402 Sat, 19 Sep 2026 08:16:51 GMT Medium Severity

Description

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

Read more at https://www.tenable.com/cve/CVE-2026-12402

]]> https://www.tenable.com/cve/CVE-2026-11899 https://www.tenable.com/cve/CVE-2026-11899 Sat, 19 Sep 2026 08:16:51 GMT Medium Severity

Description

The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.

Read more at https://www.tenable.com/cve/CVE-2026-11899

]]> https://www.tenable.com/cve/CVE-2026-11608 https://www.tenable.com/cve/CVE-2026-11608 Sat, 19 Sep 2026 08:16:50 GMT Medium Severity

Description

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Read more at https://www.tenable.com/cve/CVE-2026-11608

]]> https://www.tenable.com/cve/CVE-2026-92435 https://www.tenable.com/cve/CVE-2026-92435 Sat, 19 Sep 2026 07:16:34 GMT Medium Severity

Description

The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.

Read more at https://www.tenable.com/cve/CVE-2026-92435

]]> https://www.tenable.com/cve/CVE-2026-92430 https://www.tenable.com/cve/CVE-2026-92430 Sat, 19 Sep 2026 07:16:34 GMT Medium Severity

Description

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.

Read more at https://www.tenable.com/cve/CVE-2026-92430

]]> https://www.tenable.com/cve/CVE-2026-92425 https://www.tenable.com/cve/CVE-2026-92425 Sat, 19 Sep 2026 07:16:34 GMT Medium Severity

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.

Read more at https://www.tenable.com/cve/CVE-2026-92425

]]> https://www.tenable.com/cve/CVE-2026-92421 https://www.tenable.com/cve/CVE-2026-92421 Sat, 19 Sep 2026 07:16:34 GMT Medium Severity

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.

Read more at https://www.tenable.com/cve/CVE-2026-92421

]]> https://www.tenable.com/cve/CVE-2026-92420 https://www.tenable.com/cve/CVE-2026-92420 Sat, 19 Sep 2026 07:16:33 GMT Low Severity

Description

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.

Read more at https://www.tenable.com/cve/CVE-2026-92420

]]> https://www.tenable.com/cve/CVE-2026-92404 https://www.tenable.com/cve/CVE-2026-92404 Sat, 19 Sep 2026 07:16:33 GMT High Severity

Description

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.

Read more at https://www.tenable.com/cve/CVE-2026-92404

]]> https://www.tenable.com/cve/CVE-2026-92403 https://www.tenable.com/cve/CVE-2026-92403 Sat, 19 Sep 2026 07:16:33 GMT Low Severity

Description

The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.

Read more at https://www.tenable.com/cve/CVE-2026-92403

]]> https://www.tenable.com/cve/CVE-2026-92099 https://www.tenable.com/cve/CVE-2026-92099 Sat, 19 Sep 2026 07:16:33 GMT Medium Severity

Description

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.

Read more at https://www.tenable.com/cve/CVE-2026-92099

]]> https://www.tenable.com/cve/CVE-2026-91847 https://www.tenable.com/cve/CVE-2026-91847 Sat, 19 Sep 2026 07:16:33 GMT Medium Severity

Description

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

Read more at https://www.tenable.com/cve/CVE-2026-91847

]]> https://www.tenable.com/cve/CVE-2026-88926 https://www.tenable.com/cve/CVE-2026-88926 Sat, 19 Sep 2026 07:16:33 GMT High Severity

Description

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

Read more at https://www.tenable.com/cve/CVE-2026-88926

]]> https://www.tenable.com/cve/CVE-2026-88824 https://www.tenable.com/cve/CVE-2026-88824 Sat, 19 Sep 2026 07:16:33 GMT High Severity

Description

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.

Read more at https://www.tenable.com/cve/CVE-2026-88824

]]> https://www.tenable.com/cve/CVE-2026-86814 https://www.tenable.com/cve/CVE-2026-86814 Sat, 19 Sep 2026 07:16:33 GMT High Severity

Description

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

Read more at https://www.tenable.com/cve/CVE-2026-86814

]]> https://www.tenable.com/cve/CVE-2026-86591 https://www.tenable.com/cve/CVE-2026-86591 Sat, 19 Sep 2026 07:16:33 GMT Critical Severity

Description

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.

Read more at https://www.tenable.com/cve/CVE-2026-86591

]]> https://www.tenable.com/cve/CVE-2026-85680 https://www.tenable.com/cve/CVE-2026-85680 Sat, 19 Sep 2026 07:16:32 GMT High Severity

Description

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

Read more at https://www.tenable.com/cve/CVE-2026-85680

]]> https://www.tenable.com/cve/CVE-2026-85574 https://www.tenable.com/cve/CVE-2026-85574 Sat, 19 Sep 2026 07:16:32 GMT High Severity

Description

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

Read more at https://www.tenable.com/cve/CVE-2026-85574

]]> https://www.tenable.com/cve/CVE-2026-84750 https://www.tenable.com/cve/CVE-2026-84750 Sat, 19 Sep 2026 07:16:32 GMT Medium Severity

Description

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where the host routes only .php to the PHP handler, the same file is instead served from the site's own origin with its script intact, leading to Stored Cross-Site Scripting.

Read more at https://www.tenable.com/cve/CVE-2026-84750

]]> https://www.tenable.com/cve/CVE-2026-76790 https://www.tenable.com/cve/CVE-2026-76790 Sat, 19 Sep 2026 07:16:32 GMT High Severity

Description

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

Read more at https://www.tenable.com/cve/CVE-2026-76790

]]> https://www.tenable.com/cve/CVE-2026-76554 https://www.tenable.com/cve/CVE-2026-76554 Sat, 19 Sep 2026 07:16:32 GMT High Severity

Description

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.

Read more at https://www.tenable.com/cve/CVE-2026-76554

]]> https://www.tenable.com/cve/CVE-2026-19860 https://www.tenable.com/cve/CVE-2026-19860 Sat, 19 Sep 2026 07:16:32 GMT Medium Severity

Description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

Read more at https://www.tenable.com/cve/CVE-2026-19860

]]> https://www.tenable.com/cve/CVE-2026-16557 https://www.tenable.com/cve/CVE-2026-16557 Sat, 19 Sep 2026 07:16:32 GMT Medium Severity

Description

The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.

Read more at https://www.tenable.com/cve/CVE-2026-16557

]]> https://www.tenable.com/cve/CVE-2025-15698 https://www.tenable.com/cve/CVE-2025-15698 Sat, 19 Sep 2026 07:16:31 GMT Low Severity

Description

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Read more at https://www.tenable.com/cve/CVE-2025-15698

]]> https://www.tenable.com/cve/CVE-2026-93741 https://www.tenable.com/cve/CVE-2026-93741 Sat, 19 Sep 2026 06:16:30 GMT Critical Severity

Description

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Read more at https://www.tenable.com/cve/CVE-2026-93741

]]> https://www.tenable.com/cve/CVE-2026-92967 https://www.tenable.com/cve/CVE-2026-92967 Sat, 19 Sep 2026 03:17:18 GMT Medium Severity

Description

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author or above) into performing an action such as clicking on a specially crafted link to /wp-admin/media-upload.

Read more at https://www.tenable.com/cve/CVE-2026-92967

]]> https://www.tenable.com/cve/CVE-2026-92807 https://www.tenable.com/cve/CVE-2026-92807 Sat, 19 Sep 2026 03:17:17 GMT High Severity

Description

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as a PHP callable at line 1722 with no `is_callable()` guard, no allowlist, and no capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and username or further server-side abuse. Note that the encryption boundary does not mitigate this vector because the server itself encrypts the attacker-chosen callback during shortcode rendering, supplying any authenticated Contributor with a cryptographically valid blob that any unauthenticated visitor can subsequently replay to trigger invocation.

Read more at https://www.tenable.com/cve/CVE-2026-92807

]]> https://www.tenable.com/cve/CVE-2026-92229 https://www.tenable.com/cve/CVE-2026-92229 Sat, 19 Sep 2026 03:17:17 GMT Critical Severity

Description

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Read more at https://www.tenable.com/cve/CVE-2026-92229

]]> https://www.tenable.com/cve/CVE-2026-89334 https://www.tenable.com/cve/CVE-2026-89334 Sat, 19 Sep 2026 03:17:16 GMT Medium Severity

Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

Read more at https://www.tenable.com/cve/CVE-2026-89334

]]> https://www.tenable.com/cve/CVE-2026-89333 https://www.tenable.com/cve/CVE-2026-89333 Sat, 19 Sep 2026 03:17:16 GMT Medium Severity

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.

Read more at https://www.tenable.com/cve/CVE-2026-89333

]]> https://www.tenable.com/cve/CVE-2026-89274 https://www.tenable.com/cve/CVE-2026-89274 Sat, 19 Sep 2026 03:17:16 GMT Critical Severity

Description

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every scalar field of the recipe's structured metadata array — including the `reviewBody` field, which is populated verbatim from the `comment_content` of approved `wprm-comment-rating` comments — without sanitizing or stripping shortcode tokens before execution; the subsequent `wp_strip_all_tags()` and `strip_shortcodes()` calls operate only on the output string after execution has already fully occurred, providing no protection against server-side shortcode invocation. This makes it possible for unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on every recipe page render, causing shortcode output — such as attachment captions, private post fields, or other data exposed by installed shortcodes — to be embedded in the page's JSON-LD `reviewBody` metadata and disclosed to all visitors who load the recipe page. Successful exploitation requires the attacker's rated comment to pass the site's comment approval threshold, either via auto-approval or moderator action, before the injected shortcode begins executing on page loads.

Read more at https://www.tenable.com/cve/CVE-2026-89274

]]> https://www.tenable.com/cve/CVE-2026-89093 https://www.tenable.com/cve/CVE-2026-89093 Sat, 19 Sep 2026 03:17:16 GMT Medium Severity

Description

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. This is due to the `is_ai_bot_user()` function identifying privileged internal AI bot accounts by performing a prefix check for `'ai-chat-bot-'` against a guest record's stored IP address, which is populated verbatim from the client-controlled `X-Real-IP` request header during unauthenticated guest registration. This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check in `user_can_join()` and `user_can_read()` — to join administrator-restricted chat rooms, post messages into them, and read the private message history of other users.

Read more at https://www.tenable.com/cve/CVE-2026-89093

]]> https://www.tenable.com/cve/CVE-2026-89081 https://www.tenable.com/cve/CVE-2026-89081 Sat, 19 Sep 2026 03:17:16 GMT Medium Severity

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Read more at https://www.tenable.com/cve/CVE-2026-89081

]]> https://www.tenable.com/cve/CVE-2026-88944 https://www.tenable.com/cve/CVE-2026-88944 Sat, 19 Sep 2026 03:17:16 GMT Medium Severity

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.

Read more at https://www.tenable.com/cve/CVE-2026-88944

]]> https://www.tenable.com/cve/CVE-2026-87909 https://www.tenable.com/cve/CVE-2026-87909 Sat, 19 Sep 2026 03:17:15 GMT High Severity

Description

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. escapeshellcmd() escapes shell metacharacters but does not prevent argument injection because spaces remain as argument separators, and the filename sanitization applied at the database layer is never applied to the physical temporary file path used for ImageMagick processing.

Read more at https://www.tenable.com/cve/CVE-2026-87909

]]> https://www.tenable.com/cve/CVE-2026-84434 https://www.tenable.com/cve/CVE-2026-84434 Sat, 19 Sep 2026 03:17:15 GMT Critical Severity

Description

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the targeted form to contain a File Upload field with its Visibility set to 'Hidden'; the vulnerability is reachable by unauthenticated attackers on any publicly accessible form meeting this condition.

Read more at https://www.tenable.com/cve/CVE-2026-84434

]]> https://www.tenable.com/cve/CVE-2026-15760 https://www.tenable.com/cve/CVE-2026-15760 Sat, 19 Sep 2026 03:17:13 GMT Medium Severity

Description

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

Read more at https://www.tenable.com/cve/CVE-2026-15760

]]> https://www.tenable.com/cve/CVE-2026-15660 https://www.tenable.com/cve/CVE-2026-15660 Sat, 19 Sep 2026 03:17:13 GMT Medium Severity

Description

The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options via the attacker-supplied token that drives an outbound Google API request whose response is stored.

Read more at https://www.tenable.com/cve/CVE-2026-15660

]]> https://www.tenable.com/cve/CVE-2026-13354 https://www.tenable.com/cve/CVE-2026-13354 Sat, 19 Sep 2026 03:17:13 GMT High Severity

Description

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on instances where combine_loaded_css has been enabled.

Read more at https://www.tenable.com/cve/CVE-2026-13354

]]> https://www.tenable.com/cve/CVE-2026-12042 https://www.tenable.com/cve/CVE-2026-12042 Sat, 19 Sep 2026 03:17:12 GMT Medium Severity

Description

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Read more at https://www.tenable.com/cve/CVE-2026-12042

]]> https://www.tenable.com/cve/CVE-2026-77820 https://www.tenable.com/cve/CVE-2026-77820 Sat, 19 Sep 2026 02:16:54 GMT Medium Severity

Description

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.

Read more at https://www.tenable.com/cve/CVE-2026-77820

]]> https://www.tenable.com/cve/CVE-2026-93923 https://www.tenable.com/cve/CVE-2026-93923 Sat, 19 Sep 2026 00:16:57 GMT High Severity

Description

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

Read more at https://www.tenable.com/cve/CVE-2026-93923

]]> https://www.tenable.com/cve/CVE-2026-93922 https://www.tenable.com/cve/CVE-2026-93922 Sat, 19 Sep 2026 00:16:57 GMT High Severity

Description

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

Read more at https://www.tenable.com/cve/CVE-2026-93922

]]> https://www.tenable.com/cve/CVE-2026-93921 https://www.tenable.com/cve/CVE-2026-93921 Sat, 19 Sep 2026 00:16:57 GMT Medium Severity

Description

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

Read more at https://www.tenable.com/cve/CVE-2026-93921

]]> https://www.tenable.com/cve/CVE-2026-77875 https://www.tenable.com/cve/CVE-2026-77875 Sat, 19 Sep 2026 00:16:57 GMT Medium Severity

Description

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.

Read more at https://www.tenable.com/cve/CVE-2026-77875

]]> https://www.tenable.com/cve/CVE-2026-93740 https://www.tenable.com/cve/CVE-2026-93740 Fri, 18 Sep 2026 22:17:10 GMT Critical Severity

Description

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

Read more at https://www.tenable.com/cve/CVE-2026-93740

]]>