Linux Distros Unpatched Vulnerability : CVE-2026-14199

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. The Auth Proxy cache key...

CVE-2026-78970

JeecgBoot 3.9.2 and earlier is affected by an authorization bypass in the SystemApiController component. An authenticated attacker holding any valid JWT token can call endpoints such as queryAllUser , queryUsersByUsernames , queryUserById , and queryUsersByIds to retrieve real names, phone number...

CVE-2026-85043

Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via crafted network traffic. Chromium security severity: High...

PT-2026-85494

Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider. A namespace-limited tenant excluded from the allowlist can attach an operator-owned middleware to its...

Linux Distros Unpatched Vulnerability : CVE-2026-84185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the...

UBUNTU-CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

RHEL 10 : buildah (RHSA-2026:63332)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63332 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

Linux Distros Unpatched Vulnerability : CVE-2026-84961

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON...

PT-2026-85540

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

PT-2026-85547

Name of the Vulnerable Software and Affected Versions goose versions prior to 1.38.0 Description The software executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. This occurs because the recipe security scan skips these two fields, allowing...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

PT-2026-85552

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Authenticated attackers can inject task runs into arbitrary environments because the software fails to validate environment membership during run replay operations. This allows attackers to repla...

PT-2026-86242

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators role user can set allow private: true on their own managed webhook subscription POST/PATCH /api/v1/webhook-subscriptions. No admin check exists on this field. At...

Linux Distros Unpatched Vulnerability : CVE-2026-18329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an...

The vulnerability of the validate_timestamp_and_nonce() function in the online training platform Open edX Platform allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the validatetimestampandnonce function in the online training platform Open edX Platform relates to bypassing the authentication process. Exploiting this vulnerability could allow a malicious actor to circumvent security restrictions and gain unauthorized access to protected...

Linux Distros Unpatched Vulnerability : CVE-2026-85152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106162)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106162 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...

PT-2026-85544

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...

MAL-2026-16011 Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106160 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges...