CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

EUVD-2026-95428

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

PT-2026-108827

Name of the Vulnerable Software and Affected Versions Zombify versions prior to 1.7.8 Description An unrestricted upload of files with dangerous types allows an attacker to upload a web shell to the web server. A web shell is a malicious script that enables remote administration of the compromise...

CVE-2026-107824: Missing Authentication for Critical Function

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-108158: Improper Limitation of a Pathname to a Restricted Directory

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

PT-2026-109199

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-97031

Unknown description...

PT-2026-108977

Name of the Vulnerable Software and Affected Versions plugNmeet Server versions prior to 2.5.3 Description A path traversal issue exists in the whiteboard conversion endpoint. This allows any meeting participant to read server files by providing crafted filePath values using ../ sequences. This...

PT-2026-109164

A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni callback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...

PT-2026-109270

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.27 MariaDB server version 10.11.18 and earlier MariaDB server version 11.4.12 and earlier MariaDB server version 11.8.8 and earlier MariaDB server version 12.3.2 and earlier MariaDB server version...

CVE-2026-107818: External Control of System or Configuration Setting

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-109148

Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to probe internal hosts. Attackers with staff privileges can craft webhook requests to access internal network resources from the Ghost server...

CVE-2026-94439

Unknown description...

PT-2026-108963

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.x Description Nginx UI contains a cross-site request forgery CSRF flaw where the AuthRequired middleware accepts a browser-managed cookie named token as a valid API credential. Because management endpoints d...

Fedora 44 : xorg-x11-server-Xwayland (2026-2448dda850)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2448dda850 advisory. Update to xwayland 24.1.14 CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-9352...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.5:CLSA-2026:1791552137)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791552137 advisory. - A NULL pointer dereference in modxml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untruste...

PT-2026-109272

Name of the Vulnerable Software and Affected Versions x64dbg-MCP Server versions prior to 1.2 Description The software exposes debugger functionality over HTTP and listens on 0.0.0.0 by default. In the src/core/mcp server.zig file, the parseContentLength function parses an unbounded Content-Lengt...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2026:1791536084)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791536084 advisory. - Out-of-bounds Write vulnerability in Apache HTTP Server's modcharsetlite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...

Linux Distros Unpatched Vulnerability : CVE-2026-107675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersona...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.5:CLSA-2026:1791532612)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791532612 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context...