EUVD-2026-100805

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

PT-2026-122673

Integer overflow in the message buffer growth logic mbuf make room in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max packet size is configured above 2147483648. A packet header declaring a length above 2^31 makes the buffer size computation overflow...

PT-2026-120357

Уязвимость программного обеспечения для пула соединения в PostgreSQL PgBouncer связана с недостатками процедуры аутентификации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, обойти существующие механизмы безопасности и получить несанкционированный доступ к системе...

PT-2026-114129

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly ad...

PT-2026-113969

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.23.0 Description FileRise fails to record when a Time-based One-Time Password TOTP code has already been successfully used for a specific account and time step. An attacker possessing valid primary credentials and ...

Linux Distros Unpatched Vulnerability : CVE-2026-109969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer...

Linux Distros Unpatched Vulnerability : CVE-2026-109971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the clevis PKCS11 pin. The clevis-decrypt-pkcs11 script passes the PKCS11 token PIN as a command-line argument to pkcs11-tool, making it...

Linux Distros Unpatched Vulnerability : CVE-2026-108539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GPAC up to 26.07.0. This affects the function gffqpop of the file filtercore/filterqueue.c of the component MP4Box. Performing a...

Security Updates for Microsoft OneNote Products C2R (October 2026)

The Microsoft OneNote Products are missing a security update. It is, therefore, affected by a use after free vulnerability in Microsoft Office OneNote that allows an authorized attacker to elevate privileges locally. CVE-2026-96997 Note that Nessus has not tested for this issue but has instead...

CVE-2026-50215

A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent GPA before 7.4. When an IPv6 proxy/redirect rule is active, a local attacker with Administrator privileges can send a single crafted outbound IPv6 packet via a raw IPV6HDRINCL socket to...

PT-2026-113943

Name of the Vulnerable Software and Affected Versions Dgraph versions prior to 25.4.0 Description Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. A remote unauthenticated attacker with access to the Zero HTTP port...

PT-2026-114110

Name of the Vulnerable Software and Affected Versions OAID Tengine versions prior to 1.12.0 Description An out-of-bounds read can be triggered remotely within the tmfile Model Loader component. The issue exists in the get tm file model function located in the source file...

PT-2026-113923

An Incomplete List of Disallowed Inputs vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial-of-Service DoS. When in a BGP traffic engineering scenario a specific, valid, optional,...

PT-2026-113732

Name of the Vulnerable Software and Affected Versions Clevis affected versions not specified Description A flaw exists in the clevis PKCS11 pin where the clevis-pkcs11-afunix-socket-unlock daemon creates AF UNIX sockets without explicit permission restrictions or peer credential verification. Und...

CVE-2026-110807: Improper Resource Shutdown or Release

A weakness has been identified in sgl-project SGLang up to 0.5.19. Affected by this vulnerability is an unknown functionality of the file python/sglang/srt/managers/iostruct.py of the component generate Endpoint. This manipulation of the argument sessionparams causes denial of service. The attack...

CVE-2026-110698: Out-of-bounds Write

A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whispermodelload of the file external/whispercpp/whisper.cpp of the component Model Loader. The manipulation of the argument ndims leads to out-of-bounds write. The attack can be initiated remotely. The...

PT-2026-114021

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read t...

PT-2026-114257

Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissive umask such as 0000 or 0002, another local user who can reach the repository storage may modify a hook or add an executable to a writable hook directory. ...

PT-2026-113860

An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated adjacent attacker to cause a denial-of-service condition via a malformed RIPv2 message...

CVE-2026-110310: Observable Response Discrepancy

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...