EUVD-2026-111070

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

PT-2026-127253

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldap filter, poisoning /personnalisation/config ldap.inc.php and permitting remote code...

PT-2026-126679

Name of the Vulnerable Software and Affected Versions EPICS Base versions prior to 7.0.11 Description An integer overflow occurs during network request processing, leading to memory allocation with an incorrect size. This flaw allows the handling of attacker-supplied data to cause memory...

PT-2026-126615

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

VulnCheck KEV: CVE-2026-84999

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

Cisco Expressway Series X15.5.3 Remote Code Execution

Cisco Expressway Series versions X15.5.3 and earlier configured in a cluster contain a remote code execution vulnerability due to persistent cookies and insufficient client certificate validation. The supplied offline tool assesses saved inventory and CLI evidence...

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

PT-2026-127234

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PHP Session Serialization Desynchronization Remote Code Execution

PHP web applications that dynamically switch session serialization handlers between phpserialize and php may be susceptible to session desynchronization and injection attacks. An unauthenticated attacker can abuse the PHPSESSIONUPLOADPROGRESS mechanism to inject specially crafted session data tha...

PT-2026-127237

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the Asterisk REST Interface ARI may, under certain conditions, execute write...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146117)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146117 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146118 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

PT-2026-126653

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account...

PT-2026-126711

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to...

TencentOS Server 3: php:8.2 (TSSA-2026:1209)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1209 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146116)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146116 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146119 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

TencentOS Server 4: php (TSSA-2026:1204)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1204 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

TencentOS Server 2: php (TSSA-2026:1239)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1239 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...