CVE-2026-69317: Out-of-bounds Read

Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network...

PT-2026-88447

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node 1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false...

CVE-2026-84197: Improper Certificate Validation

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false wh...

PT-2026-88506

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirect uris, leaving client name and grant types bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...

CVE-2026-69358: Use of Uninitialized Resource

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network...

PT-2026-87462

Heap-based buffer overflow in Telnet Client allows an unauthorized attacker to execute code over a network...

PT-2026-88438

Name of the Vulnerable Software and Affected Versions Okta Hyperdrive Integration affected versions not specified Description The installer fails to mask the OAuth client secret when it is passed as an MSI property. This results in the credential being recorded in plaintext within the installer...

PT-2026-87070

A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be socially engineered into importing a...

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

PT-2026-89356

Name of the Vulnerable Software and Affected Versions curl affected versions not specified Description An issue exists where the software incorrectly handles the reuse of connections when client certificate settings are modified. This behavior can lead to the application of incorrect client...

PT-2026-88316

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions prior to 26.6.5 Description A flaw in the ScreenConnect client allows files to be transferred and executed through an active remote session without authorization or host confirmation under certain...

PT-2026-86959

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...

PT-2026-87178

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all versions may allow attacker to improper access control via...

PT-2026-87853

Name of the Vulnerable Software and Affected Versions Windows SMB Client affected versions not specified Description A use after free condition in the Windows SMB Client allows an unauthorized remote attacker to execute arbitrary code over a network and affect the system. Use after free is a memo...

VulnCheck KEV: CVE-2026-84869

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation...

PT-2026-87715

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network...

CVE-2026-69781: Missing Release of Memory after Effective Lifetime

Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network...

PT-2026-87555

Name of the Vulnerable Software and Affected Versions Windows SMB Client affected versions not specified Description A heap-based buffer overflow occurs in the Windows SMB Client, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory corruptio...

PT-2026-87509

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Client affected versions not specified Description An issue exists where the Remote Desktop Client uses an uninitialized resource. This allows an authenticated attacker with low privileges to execute arbitrary code on an...

AlmaLinux 8 : kernel-rt (ALSA-2026:64770)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64770 advisory. kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage CVE-2026-53002 kernel:...