ROS-20260820-73-0004

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

Cudy WR3000 Authentication Bypass / Command Injection

Cudy WR3000 routers suffer from authentication bypass vulnerability due to a hard-coded secret and a code injection vulnerability via unsanitized input...

PT-2026-79270

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

CVE-2026-66677: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in Leyka = 3.32.3 versions...

PT-2026-81884

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.30 through 7.0.109...

PT-2026-81888

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

The vulnerability of the logical decoding mechanism of the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Linux Distros Unpatched Vulnerability : CVE-2026-11861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for...

NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX696939)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-63.21, or 14.1 prior to 14.1-73.32, or 13.1-FIPS/NDcPP prior to 13.1-37.277, or 14.1-FIPS prior to 14.1-73.32. It is, therefore, affected by multiple vulnerabilities: -...

PT-2026-79049

Name of the Vulnerable Software and Affected Versions WildFly Elytron affected versions not specified Description Password hashing and verification processes normalize input using Unicode NFKC Normalization Form Compatibility Composition, which can collapse fullwidth characters into their ASCII...

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay...

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...

PT-2026-79060

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...

bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API Generic Security Service Application Program Interface tokens. This can lead to excessive memory consumption,...

CVE-2026-76366

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...

CVE-2026-76357

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

CVE-2026-76338

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The...

CVE-2025-36254

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service...

CVE-2026-76374 Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-76366 Information Disclosure through the REST API in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...