PT-2026-55950

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support and Privileged Remote Access versions prior to 26.2.1 BeyondTrust Remote Support and Privileged Remote Access versions prior to 25.3.3 Description A critical pre-authentication flaw exists in the authentication...

PT-2026-55951

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support affected versions not specified Description A critical pre-authentication flaw exists in the authentication subsystem. Improper processing of authentication requests allows an unauthenticated remote attacker to bypas...

CVE-2026-40139: Improper Authentication

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts...

PT-2026-56025

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.474 Description The buildHelperImage function in app/Livewire/Settings/Index.php constructs a Docker build command using the dev helper version field without proper shell escaping. This allows an attacker w...

PT-2026-55952

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support and Privileged Remote Access affected versions not specified Description A pre-authentication issue exists in the network communication subsystem. Insufficient validation of client-supplied input allows an...

FreeBSD : Weechat -- Memory leak in relay-API (d7939352-788b-11f1-b72c-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d7939352-788b-11f1-b72c-8447094a420f advisory. The Weechat project reports: Pre-auth memory leak in relay-api POST /api/handshake unfreed JSON body...

MiracleLinux 9 : dovecot-2.3.16-18.el9_8 (AXSA:2026-1023:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1023:04 advisory. dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command CVE-2025-59032 dovecot: denial of service via...

Exploit for Unrestricted Upload of File with Dangerous Type in Joomlic Icagenda

CVE-2026-48939 — iCagenda Joomla RCE Exploit Pre-Auth Arbitrary...

Exploit for Code Injection in Langflow

CVE-2026-27966 — Langflow Remote Code Execution Scanner Pre-Auth...

Exploit for Unrestricted Upload of File with Dangerous Type in Ollyo Sp_Page_Builder

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE...

Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.26.0, a childless box that resolves to a pathologically tall height was amplified into thousands of blank PDF pages, even when it produces no visible output. The...

UBUNTU-CVE-2026-14570

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit integer for prime search. The signing nonce a...

PT-2026-58095

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.17 Roundcube Webmail versions 1.7.x prior to 1.7.2 Description The TNEF decoder is subject to a denial of service when processing a crafted compressed-RTF size. TNEF Transport Neutral Encapsulation Forma...

Weechat -- Memory leak in relay-API

The Weechat project reports: Pre-auth memory leak in relay-api POST /api/handshake unfreed JSON body → unauthenticated remote memory-exhaustion DoS...

Exploit for CVE-2026-57517

Control Web Panel 0.9.8.1224 — Blind SQL Injection to Remot...

SUSE CVE-2026-54891

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl tlsgenconnection module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The...

CVE-2025-71359

The CVE concerns the Python package picklescan prior to version 0.0.29, where the vulnerability lies in deserializing pickle payloads that leverage lib2to3.pgen2.grammar.Grammar.loads within the reduce method. This can enable remote code execution during pickle.load() , by crafting pickle files t...

Linux Distros Unpatched Vulnerability : CVE-2026-33592

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is n...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the pre-receive process. An attacker can gain unauthorized write access to the entire repository by exploiting cached branch-specific write-permission results across multiple refs within a single session...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the pre-receive process. An attacker can gain unauthorized write access to the entire repository by exploiting cached branch-specific write-permission results across multiple refs within a single session...