PT-2026-109668

Name of the Vulnerable Software and Affected Versions PDFMathTranslate pdf2zh versions prior to 1.9.12 Description An unauthenticated attacker can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. The issue exists...

CVE-2026-27350: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta...

Linux Distros Unpatched Vulnerability : CVE-2026-106428

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

CVE-2026-108671: Missing Authorization

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations because the queryById permission check is commented out. Attackers can obtain record ids from the unguarded /airag/app/queryById endpoint and retrieve MCP...

PT-2026-114460

Уязвимость пользовательского интерфейса Nginx UI сервера nginx связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

PT-2026-109647

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 5.6.6 Description An OS command injection issue exists in the call recordings::download function. Unauthenticated attackers can execute commands as the web server user by placing calls with malicious caller ID value...

OPENSUSE-SU-2026:12104-1 xorg-x11-server-21.1.24-2.1 on GA media

These are all security issues fixed in the xorg-x11-server-21.1.24-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-110319

Name of the Vulnerable Software and Affected Versions xorg-x11-server versions prior to 21.1.24-2.1 xwayland versions prior to 24.1.13-2.1 Description Security issues were identified in the xorg-x11-server and xwayland packages within the openSUSE Tumbleweed GA media. Recommendations Update...

PT-2026-110328

Name of the Vulnerable Software and Affected Versions xorg-x11-server versions prior to 21.1.24-2.1 xwayland versions prior to 24.1.13-2.1 Description Security issues were identified in the xorg-x11-server and xwayland packages within the openSUSE Tumbleweed GA media. Recommendations Update...

PT-2026-110329

Name of the Vulnerable Software and Affected Versions xorg-x11-server versions prior to 21.1.24-2.1 xwayland versions prior to 24.1.13-2.1 Description Security issues were identified in the xorg-x11-server and xwayland packages within the openSUSE Tumbleweed GA media. Recommendations Update...

PT-2026-109675

Name of the Vulnerable Software and Affected Versions argocd-mcp Argo CD MCP Server versions prior to 0.9.1 Description A path traversal issue exists in the delete application tool. This occurs when the applicationName variable is not properly validated, allowing MCP clients or prompt-injected...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the repo-server process when cloning, testing, or fetching an SSH Git repository configured with a crafted proxy URL. An attacker can execute arbitrary commands on the server by supplying a specially crafted proxy...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the repo-server process when cloning, testing, or fetching an SSH Git repository configured with a crafted proxy URL. An attacker can execute arbitrary commands on the server by supplying a specially crafted proxy...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the repo-server process when cloning, testing, or fetching an SSH Git repository configured with a crafted proxy URL. An attacker can execute arbitrary commands on the server by supplying a specially crafted proxy...

CVE-2026-107854

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

Security Bulletin: Due to use of Apache Http Server, IBM Cloud Pak System is affected by HTTP Response splitting [CVE-2024-24795]

Summary HTTP Response splitting vulnerability has been identified in Apache HTTP Server. This vulnerability was addressed by IBM Cloud Pak System 2.3.6.2 Vulnerability Details CVEID:CVE-2024-24795 DESCRIPTION: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker th...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...