PT-2026-104019

Name of the Vulnerable Software and Affected Versions PictShare versions prior to 3.7.1 Description An information disclosure issue exists where unauthenticated attackers can obtain the secret delete code and uploader metadata. This occurs when calling the 'API::info' endpoint, which returns the...

PT-2026-103981

Name of the Vulnerable Software and Affected Versions Joyland AI affected versions not specified Description The application contains hard-coded credentials for the GeTui push notification service. This allows an attacker to access the GeTui REST API and send push notifications with arbitrary...

PT-2026-103969

🚨 CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, ...

CVE-2026-67172: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-12405: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...

CVE-2026-103271: Incorrect Authorization

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-101147: Cross-Site Request Forgery (CSRF)

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

PT-2026-105922

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLC KEY or --key without also pinning the URL...

PT-2026-105807

A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One mechanism logs session identifiers, which are treated as authentication credentials, at an informational level. The other, when debug...

PT-2026-105819

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

PT-2026-103939

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-96255: Exposure of Sensitive Information to an Unauthorized Actor

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2021_2168)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20212168 advisory. kernel: userspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu-run CVE-2021-3501 kernel: nitroenclav...

Rocky Linux 8 [CIQ] Security Update: fence-agents-aliyun / fence-agents-aliyun-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_1240)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20261240 advisory. urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66418 urllib3: urllib3 Streaming API improperly handles highly...

Rocky Linux 8 [CIQ] Security Update: apache-commons-collections / apache-commons-lang / bea-stax-api / etc Multiple Vulnerabilities (crlba-2019_3416)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlba-20193416 advisory. For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section. This advisory is provided by...

Rocky Linux 8 [CIQ] Security Update: lemon / lemon-debuginfo / sqlite / sqlite-debuginfo / etc (crlsa-2023_0110)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20230110 advisory. sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API CVE-2022-35737 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: crit / criu / criu-debuginfo / criu-debugsource / libslirp / etc (crlsa-2021_0531)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20210531 advisory. podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API CVE-2020-14370 Tenable has extracted the preceding...

Rocky Linux 9.6 [TuxCare] Security Update: rhel-net-naming-sysattrs / systemd / systemd-boot-unsigned / etc (ALMALINUX9.6:CLSA-2026:1779217317)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779217317 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-67104: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation...