CVE-2026-48791

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...

PT-2026-71829

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can bypass security restrictions because of improper validation of anti-CSRF tokens. Cross-Site Request Forgery CSRF is a type of attack that tricks a victim into...

PT-2026-71515

Subscriber SQL Injection in Do Lasso = 358 versions...

ROS-20260813-73-0042

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0029

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0012

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0010

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260813-73-0025

The vulnerability in Gitea is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to increase their privileges...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-7.5.1.10)

The version of AOS installed on the remote host is prior to 7.5.1.10. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-7.5.1.10 advisory. - A flaw was found in gnutls. Servers configured with RSA-PSK RivestShamirAdleman Pre-Shared Key wrongfully matched usernam...

PT-2026-71814

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation...

PT-2026-71887

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

PT-2026-71512

Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...

IBM WebSphere Application Server Liberty 17.0.0.3 < 26.0.0.9 (7283488)

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 7283488 advisory. - IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled...

Linux Distros Unpatched Vulnerability : CVE-2026-48804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-socketio is a Python implementation of the Socket.IO realtime client and server. The python- socketio server stores binary EVENT and ACK messages in memo...

PT-2026-71911

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner changeTenantOwnerEmail endpoint. On self-hosted instances SELF HOSTED or DISABLE ACCOUNT PORTAL set, the cloudRestricted middleware is a no-op and the route is protected only b...

Schneider Electric PowerChute Serial Shutdown < 1.6 Improper Restriction of Excessive Authentication Attempts (SEVD-2026-223-01)

The version of Schneider Electric PowerChute Serial Shutdown installed on the remote host is prior to 1.6. It is, therefore, affected by a vulnerability. - CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized...

PT-2026-71529

Unauthenticated Broken Authentication in Log in with Google = 1.4.2 versions...

PT-2026-71882

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in amp conf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...

VulnCheck KEV: CVE-2026-26190

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath...

iscsi-initiator-utils security, bug fix, and enhancement update

6.2.1.11-1.git4b3e853.0.1.el98.2 - iscsi validate interface IP against target address family Orabug: 39491394 - iscsi delay reconnect until interface has valid IP Orabug: 38441836 - Correct the typos in email addresses in changelog in OL9.5 Orabug: 37910459 - Change the order of restart iscsi...