PT-2026-67139

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2026.3.2 Description An incomplete patch allows for authentication bypass and account takeover. This issue occurs when an attacker uses an alternate path or channel to bypass the authentication mechanism...

Linux Distros Unpatched Vulnerability : CVE-2026-67297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 fails to enforce the RESPONSESIZELIMIT when processing Transfer-Encoding: chunked HTTP responses in httpresponserecvbody. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-67296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before strea...

Linux Distros Unpatched Vulnerability : CVE-2026-67355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as...

[SECURITY] Fedora 43 Update: libgit2-1.9.6-1.fc43

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language with bindings...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and xlink:href attribut...

Linux Distros Unpatched Vulnerability : CVE-2026-56818

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears...

Linux Distros Unpatched Vulnerability : CVE-2026-62941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check...

Oracle Linux 9 : nodejs:22 (ELSA-2026-47058)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47058 advisory. - Fix CVE-2026-59873, CVE-2026-59874 node-tar by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 brace-expansion in npm's bundled...

Linux Distros Unpatched Vulnerability : CVE-2026-62940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configurati...

Oracle Linux 8 : nodejs:22 (ELSA-2026-47059)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47059 advisory. - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-193842 RHEL-193874 RHEL-208661 - Update to...

Linux Distros Unpatched Vulnerability : CVE-2026-62867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume...

Linux Distros Unpatched Vulnerability : CVE-2026-63343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-63125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project- confined Incus user a non-admin TLS/RBAC identity wit...

Linux Distros Unpatched Vulnerability : CVE-2026-62313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be...

CVE-2026-53573

CVE-2026-53573 affects GeoNetwork core-geonetwork (3.12.0 to 4.2.16 and 4.4.11) where unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter allows an attacker-controlled external redirect after login. Root cause: improper validation ena...

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

Impact Remote denial of service via panic while parsing a crafted ECDHEPSK ServerKeyExchange message. Patches Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue. Workarounds No work around; please upgrade to v3.1.4 or a newer...

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Summary apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck causes this to bypass authorization on all piece-type REST API endpoint...

GHSA-6H5J-32CF-4253 Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

Summary apos.util.set traverses dot-notation paths without sanitizing proto, allowing an authenticated editor to write arbitrary values to Object.prototype via the $pullAll patch operator. A confirmed gadget in publicApiCheck causes this to bypass authorization on all piece-type REST API endpoint...

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

NPM: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...