PT-2026-98824

Name of the Vulnerable Software and Affected Versions Wellav WES Emergency Broadcast Terminal WES100 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES270 versions prior to 08-08-2023 Wellav WES Emergency Broadcast Terminal WES280 versions prior to 08-08-2023 Wellav WES...

PT-2026-99009

Parse Server versions = 9.0.0 before 9.10.0 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still returned i...

PT-2026-99016

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...

CVE-2026-51772

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

PT-2026-98413

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/serial-number-types' endpoint, where...

PT-2026-98416

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious...

PT-2026-99130

Name of the Vulnerable Software and Affected Versions Flame versions prior to 2.4.1 Description An information exposure issue exists in the unauthenticated 'GET /api/config' endpoint, which returns the complete configuration object without redacting sensitive fields. This allows an attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-66073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pU...

Linux Distros Unpatched Vulnerability : CVE-2026-97980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 s390/debug: Ad...

Linux Distros Unpatched Vulnerability : CVE-2026-67408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows...

EUVD-2026-87085

A Server-Side Request Forgery SSRF vulnerability exists in the Image API v2 of OpenStack Glance. When the showmultiplelocations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted...

PT-2026-99082

Name of the Vulnerable Software and Affected Versions Zammad versions 7.0.3 through 7.1.1 Description An authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. The system fails to consistently mask sensitive fields in certain...

Etcd gRPC Authorization Bypass

The vulnerability of the gRPC authentication mechanism for Etcd configuration stores is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions from a remote location...

Linux Distros Unpatched Vulnerability : CVE-2026-98156

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to...

CVE-2026-53625: Missing Authorization

GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a...

CVE-2026-52622

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function...

PT-2026-98917

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.1.0 through 4.1.10 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description An authenticated low-privileged management user with vhost access can cause a denial of service on a memory-limited...

CVE-2026-98156

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...

PT-2026-98415

Name of the Vulnerable Software and Affected Versions StockAgile affected versions not specified Description Stored Cross-Site Scripting XSS occurs in the API and management panel. The issue exists on the server side within the '/inventory/configuration/categories' endpoint, where malicious...

PT-2026-98354

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.4 Description Incorrect authorization exists in the api/controllers/User.php file when the id variable is set to "admins" or "all". Recommendations Update to version 1.8.4 or later...