PT-2026-104194

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks

Security benchmarks for LLM-based agents often report the attack success rate ASR as a measure of model robustness and use these scores to compare different models and defense mechanisms, assuming that they describe the security of the agent. In this paper, we explore whether it also influences t...

PT-2026-104346

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument g name results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

PT-2026-104209

A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to th...

Defense-In-Depth at the Perception-Reasoning Interface of LLM-Centric Agentic UAV Swarms

Large Language Models LLMs increasingly support Uncrewed Aerial Vehicle UAV swarm operations such as data collection scheduling, where the model reads structured sensor reports and decides which sensors to visit. An adversary who quietly manipulates those reports can redirect the swarm without...

Linux Distros Unpatched Vulnerability : CVE-2026-97876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while...

Rocky Linux 9 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc (crlsa-2026_73955)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202673955 advisory. openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay CVE-2026-60001 Tenable has extracted the preceding description block...

Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-46037)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505962; scriptversion"1.2"; scriptsetattributeattribute:"pluginmodificationdate",...

Linux Distros Unpatched Vulnerability : CVE-2026-103431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it,...

Fedora 45 : cockpit-machines (2026-2afda0f514)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2afda0f514 advisory. Automatic update for cockpit-machines-357-1.fc45. Changelog for cockpit-machines Wed Sep 23 2026 Packit - 357-1 - Harden against local attacks from...

CVE-2026-103627: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Medium...

PT-2026-104406

Name of the Vulnerable Software and Affected Versions Nx versions prior to 22.7.9 Nx versions 23.0.0 through 23.1.1 Description Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without restricting permissions to the owner. On shared build...

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489...

CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

foreman: command injection in foreman-tail

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

CVE-2026-71453

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-64893

Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25...

CVE-2026-64893

The Johnson Controls EasyIO Neo series (EC and CW controllers) is vulnerable to a Cleartext Transmission of Sensitive Information vulnerability (CWE-319). This flaw allows an attacker to intercept and read sensitive data, such as credentials and session data , transmitted over the network via a M...