PT-2026-114460

Уязвимость пользовательского интерфейса Nginx UI сервера nginx связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...

PT-2026-109668

Name of the Vulnerable Software and Affected Versions PDFMathTranslate pdf2zh versions prior to 1.9.12 Description An unauthenticated attacker can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended location. The issue exists...

CVE-2026-108582: Incorrect Permission Assignment for Critical Resource

GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to re...

OPENSUSE-SU-2026:12104-1 xorg-x11-server-21.1.24-2.1 on GA media

These are all security issues fixed in the xorg-x11-server-21.1.24-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-109647

Name of the Vulnerable Software and Affected Versions FusionPBX versions prior to 5.6.6 Description An OS command injection issue exists in the call recordings::download function. Unauthenticated attackers can execute commands as the web server user by placing calls with malicious caller ID value...

Linux Distros Unpatched Vulnerability : CVE-2026-106428

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed...

Linux Distros Unpatched Vulnerability : CVE-2026-107817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the repo-server process when cloning, testing, or fetching an SSH Git repository configured with a crafted proxy URL. An attacker can execute arbitrary commands on the server by supplying a specially crafted proxy...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the repo-server process when cloning, testing, or fetching an SSH Git repository configured with a crafted proxy URL. An attacker can execute arbitrary commands on the server by supplying a specially crafted proxy...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the repo-server process when cloning, testing, or fetching an SSH Git repository configured with a crafted proxy URL. An attacker can execute arbitrary commands on the server by supplying a specially crafted proxy...

CVE-2026-107854

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

CVE-2026-107854 Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled serverid and loads the server without restricting the lookup to servers owned by the authenticated account. On installations...

Security Bulletin: Due to use of Apache Http Server, IBM Cloud Pak System is affected by HTTP Response splitting [CVE-2024-24795]

Summary HTTP Response splitting vulnerability has been identified in Apache HTTP Server. This vulnerability was addressed by IBM Cloud Pak System 2.3.6.2 Vulnerability Details CVEID:CVE-2024-24795 DESCRIPTION: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker th...

CVE-2026-107840

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopasshttprequeststotal and yopasshttprequestdurationseconds...

CVE-2026-107822

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. ...

CVE-2026-107824

x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...

CVE-2026-107817

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data cou...

DEBIAN-CVE-2026-107817

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysqljson plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data cou...

DEBIAN-CVE-2026-107816

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qcinfo plugin could be confused by a query containing embedded null bytes. Reading informationschema.querycacheinfo after such a query was cached could acces...