PT-2026-107839

Name of the Vulnerable Software and Affected Versions SecuShare Pro version 4 Description SecuShare Pro contains an OS Command Injection flaw that allows unauthenticated remote attackers to inject and execute arbitrary operating system commands on the server. OS Command Injection is a flaw where ...

PT-2026-108715

Name of the Vulnerable Software and Affected Versions praisonai version 4.6.63 Description The MCP HTTP-stream server fails to enforce authentication by default because the --api-key CLI argument defaults to None. This allows unauthenticated requests to the /mcp endpoint, enabling attackers to...

PT-2026-107955

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88 Description An integer underflow occurs in the trimTransparent function within WinCursorShapeUtils when a cursor shape with a width or height of zero is processed on the DXGI captur...

PT-2026-108036

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 9.0.3 Description The libssh-based sftp protocol handler lacks host key verification, which allows network attackers to impersonate SFTP servers. Attackers utilizing man-in-the-middle, DNS, or ARP spoofing can capture...

CVE-2026-107675: Key Exchange without Entity Authentication

FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged...

PT-2026-108114

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to 7.1.4 FFmpeg versions 8.0.x prior to 8.0.2 Description A server-side request forgery issue exists in the ff rtsp connect function within libavformat/rtsp.c. The software follows RTSP 3xx redirects without validating th...

ROS-20261008-73-0028

The vulnerabilities of the functions setposixaclentriesdacl and setntacldacl in the fs/smb/server/smbacl.c module are related to integer overflows. Exploiting these vulnerabilities could allow an attacker to cause a service failure...

CVE-2026-94439: Inconsistent Interpretation of HTTP Requests

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server...

PT-2026-108247

Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions prior to 8.2.3 AdonisJS HTTP Server versions prior to 9.3.0 Description Route parameter values are inserted into URLs without proper encoding in the shared createURL helper, which is utilized by Router.makeUrl and...

PT-2026-108108

Name of the Vulnerable Software and Affected Versions Malcolm affected versions not specified Description The file-upload component incorporates the FilePond PHP server, which includes an index.php file exposing a fetch API route. This route allows the server to download an arbitrary URL using cu...

openSUSE 16 Security Update : python-fsspec (openSUSE-SU-2026:22028-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22028-1 advisory. Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

EulerOS 2.0 SP15 : libXfont2 (EulerOS-SA-2026-3983)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client...

PT-2026-107977

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A heap buffer overflow exists in the distributed pixel cache server. This occurs when connecting clients send crafted data, allowing them to overwrite heap memory. An attacker can exploit this...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791458607)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791458607 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' response smuggling vulnerability in Apache HTTP...

EulerOS 2.0 SP15 : libXfont2 (EulerOS-SA-2026-3917)

According to the versions of the libXfont2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A heap buffer overflow in pcfReadFont due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client...

PT-2026-107987

Name of the Vulnerable Software and Affected Versions Parse Server versions 8.2.2 through 8.6.91 Parse Server versions 9.0.0 through 9.10.1-alpha.11 Description An information disclosure issue exists where GraphQL validation error messages reveal hidden class names even when public introspection ...

CVE-2026-107612: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global...

CVE-2026-105828: Generation of Error Message Containing Sensitive Information

Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send...

CVE-2026-87686: Authentication Bypass by Spoofing

An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socke...

CVE-2026-107292: Origin Validation Error

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.toweb and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a...