PT-2026-80747

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

The vulnerability of the psql utility in the PostgreSQL database management system allows a hacker to execute arbitrary commands.

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1596:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1596:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-231-01)

The version of mozilla-firefox installed on the remote host is prior to 140.14.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-231-01 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

PT-2026-78924

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.33.4 n8n versions 2.34.x prior to 2.34.1 Description A remote code execution issue exists in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader determines a node's schema module path...

PT-2026-79129

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.173 Description A use after free issue in the DOM allows a remote attacker to execute arbitrary code inside the sandbox by inducing the user to open a crafted HTML page. Use after free is a memory...

VulnCheck KEV: CVE-2021-23758

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution...

KLA91236 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability...

JetBrains IntelliJ IDEA < 2026.2.1 Multiple Vulnerabilities

The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains IntelliJ IDEA before 2026.2.1 RCE via Markdown export tool was possible. CVE-2026-75056 - In JetBrains IntelliJ IDEA before 2026.2.1 SSR...

PT-2026-80753

Name of the Vulnerable Software and Affected Versions Fleet affected versions not specified Description A SQL injection exists in the Okta conditional access integration. An attacker controlling a single enrolled host can provide a value via the host agent that is used in a database query without...

PT-2026-79088

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

Linux Distros Unpatched Vulnerability : CVE-2026-76217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply...

RHEL 8 : python-urwid (RHSA-2026:57637)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57637 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

The vulnerability of the logical decoding mechanism of the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

RHEL 8 : python-urwid (RHSA-2026:57638)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57638 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Dell Wyse Management Suite < 2605.0.2 Multiple Vulnerabilities (DSA-2026-329)

The version of Dell Wyse Management Suite installed on the remote host is prior to 2605.0.2. It is, therefore, affected by multiple vulnerabilities, including: - Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A...

PT-2026-79199

Name of the Vulnerable Software and Affected Versions Azure Managed Instance for Apache Cassandra affected versions not specified Description Improper neutralization of argument delimiters in a command, known as argument injection, allows an unauthorized attacker to execute code over a network...

PT-2026-79131

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.173 Description Improper resource control in Linux Toolkit Theming allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox by using a crafted HT...