VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-logkit (UTSA-2026-093014)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093014 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-framework (UTSA-2026-093017)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093017 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

UBUNTU-CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-elytron (UTSA-2026-031644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031644 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: datanucleus-api-jdo (UTSA-2026-093015)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093015 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-security-manager (UTSA-2026-030642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030642 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: avalon-logkit (UTSA-2026-093012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093012 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

PT-2026-83251

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.8 Yamcs versions prior to 5.13.2 Description Yamcs compiles StreamSQL query expressions to Java at runtime using Janino. The LIKE operator inserts user-supplied patterns into the generated Java source unescaped. An...

PT-2026-83261

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of parameter or argument delimiters allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment, ther...

PT-2026-83056

Name of the Vulnerable Software and Affected Versions ManageSieve affected versions not specified Description An attacker with valid credentials can submit a Sieve script containing an extreme numeric literal. This triggers an out-of-bounds write during script compilation by the ManageSieve...

PT-2026-82833

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon denial of service and potentially achieve remote code execution. This is in http microhttpd.c...

CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: datanucleus-api-jdo (UTSA-2026-093016)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093016 advisory. Apache Log4j2 versions 2.0-beta7 through 2.17.0 excluding security fix releases 2.3.2 and 2.12.4 are vulnerable to a remote code execution RCE attack when a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-common (UTSA-2026-093013)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093013 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

KLA91246 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An...

PT-2026-83332

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint...

MiracleLinux 9 : gstreamer1-plugins-good-1.22.12-7.el9_8.8 (AXSA:2026-1684:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1684:07 advisory. gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow CVE-2026-18296 gstreamer: GStreamer: Remote code executi...

PT-2026-83281

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: jboss-logging (UTSA-2026-031578)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031578 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...