PT-2026-98221

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 10.6.7 Description In simple-auth deployments using per-user filters, the streamEvents function in internal/web/events.go fails to apply label filters to the container-stat and container-event channels returned by the...

PT-2026-98216

Name of the Vulnerable Software and Affected Versions Honeywell PD45 Industrial Printer versions F10.19.010040 through F10.22.030744 Description An unauthenticated Remote Code Execution RCE issue exists in the HTTPS web management interface. This is caused by an arbitrary file upload flaw that...

PT-2026-98262

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in other users' browsers via stored client-side template injection. This occurs when Vue.js template expressions, using double-brace syntax...

PT-2026-98264

Name of the Vulnerable Software and Affected Versions Krayin CRM versions prior to 2.2.7 Description Authenticated attackers can execute arbitrary JavaScript in the browsers of other users via a stored client-side template injection. By injecting Vue.js template expressions into the web form...

D-Link DAP-1360 Code Execution

The vulnerability of the web interface for managing microprogrammed wireless access points from D-Link DAP-1360 is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted...

CVE-2026-96515: Missing Authorization

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

PT-2026-97701

Name of the Vulnerable Software and Affected Versions Fabasoft Folio Client versions prior to 2026 Description A locally installed component that communicates with the browser extension via web messaging does not restrict which web origins may invoke its functions by default. The registry value...

CVE-2026-13248: External Control of File Name or Path

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version...

PT-2026-97779

Name of the Vulnerable Software and Affected Versions Paessler PRTG Network Monitor versions prior to 26.2.120.1449 Description A reflected Cross-Site Scripting XSS issue exists where the web interface returns an HTTP 403 Forbidden Path error page when a request is made for a non-existent resourc...

Dark Web Roast - August 2026 Edition

Dark Web Roast – August 2026 Edition By Trellix Advanced Research Center · September 24, 2026 Executive Summary August 2026 was another month where the underground did most of our investigative work for us, and this time it barely required a magnifying glass. The headline act was comedyclub on...

automation-controller: automation-controller-container: automation-controller: CUSTOM_VENV_PATH setting provides filesystem path-existence oracle on control pod

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

automation-controller: automation-controller: CredentialType injector validation renders attacker-supplied Jinja2 templates synchronously in the web worker, allowing uncontrolled resource consumption (denial of service) and an unhandled-exception (500) via /api/controller/v2/credential_types/

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

AZL-105747 CVE-2026-67405 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

DEBIAN-CVE-2026-67405

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

AZL-105795 CVE-2026-67232 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

DEBIAN-CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67405

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

UBUNTU-CVE-2026-67405

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...

UBUNTU-CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...