Linux Distros Unpatched Vulnerability : CVE-2026-101906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular...

Linux Distros Unpatched Vulnerability : CVE-2026-102414

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than t...

SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:4391-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4391-1 advisory. - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler bsc1275501. - CVE-2026-59903: Netty...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libevent vulnerabilities (USN-8840-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8840-1 advisory. Micha Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly...

UBUNTU-CVE-2026-16271

hw/display/qxl: validate primary surface stride against width...

PT-2026-103490

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields = 3.3.8 versions...

PT-2026-103061

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...

PT-2026-103104

Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...

PT-2026-103135

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's...

PT-2026-103012

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service...

PT-2026-103521

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fiel...

PT-2026-103321

🚨 CVE-2026-100274 In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template 🎖@cveNotify...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

PT-2026-103516

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description The gateway WebSocket transport contains an allocation of resources without limits. This allows connected gateways to exhaust node memory by sending an unending sequence of WebSocket...

PT-2026-103496

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

PT-2026-103497

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial ...

PT-2026-103585

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.18.0 Description A flaw in the way the library handles crafted PDF files can lead to uncontrolled resource consumption. Specifically, when a PDF contains indirect-object identifiers or generation-number tokens that...

PT-2026-103588

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.18.1 Description A crafted PDF containing a partially malformed /FlateDecode stream with padded data can force the pypdf/filters.py file to use inefficient byte-by-byte decompression. This occurs because the recovery...

PT-2026-103590

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.19.0 Description A crafted PDF containing numerous embedded files can cause the dictionary-based attachments API in pypdf/ doc common.py to reparse the entire attachment list during every content lookup. This results ...

PT-2026-103281

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...