EUVD-2026-50954

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory...

CVE-2026-18187

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory...

CVE-2026-18186 A stored format string vulnerability was found in the FTP Backup on the ADM

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...

CVE-2026-18186

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...

PT-2026-66520

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.1 Description Improper access control allows authenticated users to access and manipulate build jobs belonging to other users. This issue occurs through the log retrieval and unauthenticated build...

PT-2026-66617

Name of the Vulnerable Software and Affected Versions open62541 affected versions not specified Description A heap use-after-free issue exists in the TransferSubscriptions service. This occurs when the application continues to use a pointer after the memory it points to has been freed, which may...

PT-2026-66501

Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description An issue in the customer REST API allows an authenticated user with low privileges to access an endpoint that returns records belonging to other users. This occurs because the system fails to...

B&R Automation X20EDS410 Improper Privilege Management (CVE-2026-46333)

The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's ptrace getdumpable logic used by ptracemayaccess. Successful local exploitation of this vulnerability could allow an authenticated attacker with low privileges to escala...

PT-2026-66506

Name of the Vulnerable Software and Affected Versions Kanboard versions prior to 1.2.53 Description Authenticated users can bypass server-side request forgery SSRF protections by using hexadecimal IP address notation in user-controlled URLs. Through the web link creation feature, attackers can...

PT-2026-66454

Name of the Vulnerable Software and Affected Versions Eaton Tripp Lite Series PADM firmware affected versions not specified Description Improper input validation in a session management interface allows an authenticated administrator to execute arbitrary commands within a restricted environment...

PT-2026-66455

Name of the Vulnerable Software and Affected Versions Eaton Tripp Lite PADM firmware affected versions not specified Description Improper input validation in a session management interface allows an authenticated user to elevate privileges, potentially granting unrestricted access to the device...

PT-2026-66500

Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description A flaw in the customer REST API allows any authenticated user to retrieve cleartext payment-processor merchant credentials within the response body. Recommendations At the moment, there is no...

PT-2026-66469

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...

MongoDB 8.3.x < 8.3.7 Aggregation Framework Memory Exhaustion (SERVER-128584)

The version of MongoDB installed on the remote host is 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user can cause a mongod process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation...

Linux Distros Unpatched Vulnerability : CVE-2026-14643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no- cache or private Cache-Control directive. In undici...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...

PT-2026-66477

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.1.2.0 through 6.1.2.7 2 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through...

erlang -- SSH plaintext recovery attack against CBC ciphers

The Erlang/OTP team reports: The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 section 6. For CBC ciphers, a timing-safe "packet discard" mechanism CVE-2008-5161 mitigation ensures structural errors are indistinguishable from MAC...

UBUNTU-CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...