CVE-2026-108473

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication or authorization, allowing modification of the device state o...

EUVD-2026-100757

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive...

Juniper Junos OS Vulnerability (JSA112180)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA112180 advisory. - An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific...

Security Updates for Microsoft OneNote Products C2R (October 2026)

The Microsoft OneNote Products are missing a security update. It is, therefore, affected by a use after free vulnerability in Microsoft Office OneNote that allows an authorized attacker to elevate privileges locally. CVE-2026-96997 Note that Nessus has not tested for this issue but has instead...

Linux Distros Unpatched Vulnerability : CVE-2026-108539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GPAC up to 26.07.0. This affects the function gffqpop of the file filtercore/filterqueue.c of the component MP4Box. Performing a...

FreeBSD : Timing leaks of the nonce in ECDSA, EdDSA and DSA signatures (07e99f22-c176-4c8f-9678-a57ba8114959)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 07e99f22-c176-4c8f-9678-a57ba8114959 advisory. Helder Eijs reports Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures The signing time...

CVE-2026-50215

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

EUVD-2026-100805

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

PT-2026-113676

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student...

FreeBSD: VID-fac18f5f-afc2-11f1-8266-3c7c3fba4204 (CVE-2026-70402): Gitea -- multiple vulnerabilities

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. ...

Debian: CVE-2026-53612: util-linux -- security update

util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID mount utility's hookowner.c post-mount hook performs path-based chmod and lchown operations on a previously validated mount target. A local low-privileged user authorized by a...

PT-2026-114107

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.6.9 OpenSIPS versions prior to 4.0.2 Description A remote attack can trigger an out-of-bounds read within the rtpproxy component. This issue occurs specifically in the rtpproxy offer and rtpproxy answer functions...

PT-2026-113752

Name of the Vulnerable Software and Affected Versions PCMan FTP Server versions prior to 2.0.8 Description A buffer overflow occurs in the PORT Command Handler component. This issue allows a remote attacker to cause a crash or potentially execute arbitrary code by manipulating an unknown function...

PT-2026-114257

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. ...

PT-2026-113943

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.4.0 Description Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port...

PT-2026-113969

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.23.0 Description FileRise fails to record when a Time-based One-Time Password TOTP code has already been successfully used for a specific account and time step. An attacker possessing valid primary credentials and ...

PT-2026-114031

Name of the Vulnerable Software and Affected Versions S3 .NET Encryption Client versions prior to 3.2.2 S3 .NET Encryption Client versions prior to 4.0.3 Description A padding oracle flaw exists in the S3 .NET Encryption Client. A remote user with read access to encrypted objects in an S3 bucket...

PT-2026-114110

Name of the Vulnerable Software and Affected Versions OAID Tengine versions prior to 1.12.0 Description An out-of-bounds read can be triggered remotely within the tmfile Model Loader component. The issue exists in the get tm file model function located in the source file...

PT-2026-114108

Name of the Vulnerable Software and Affected Versions OpenClaw ClawScan versions prior to 0.1.7 Description A flaw in the Static Scanner component allows a local attacker to cause a protection mechanism failure. This issue occurs within the shouldSkipTargetPath function located in the...

PT-2026-114129

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly ad...