PHP 8.2.x < 8.2.34 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.2.34. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.34 advisory. - Debian Linux - php8.2 - None php8.4 - None CVE-2025-1218, CVE-2025-14181, CVE-2026-6103, CVE-2026-91765, CVE-2026-91766,...

CVE-2026-97508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return error to the remote host. However, we need to make sure we keep the uui...

CVE-2026-18857: Out-of-bounds Read

IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to...

Linux Distros Unpatched Vulnerability : CVE-2026-97520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gfs2: move quotainit qc iterator increment Move qc++ from the loop body into the for-loop increment expression in gfs2quotainit. This keeps iterator progression...

Linux Distros Unpatched Vulnerability : CVE-2026-97410

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the...

Linux Distros Unpatched Vulnerability : CVE-2026-97508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - thunderbolt: Set tb-rootswitch to NULL when domain is stopped Similarly what we do with the firmware connection manager. This makes tbxdphandlerequest return...

CVE-2026-96748: Improper Handling of URL Encoding (Hex Encoding)

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of the...

Linux Distros Unpatched Vulnerability : CVE-2026-93278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - staging: octeon: add missing napidisable in cvmoctrxshutdown cvmoctrxshutdown calls freeirq and netifnapidel without disabling the napi instance first. As the...

CVE-2026-79759: Authorization Bypass Through User-Controlled Key

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values...

CVE-2026-97360: Missing Authorization

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

Linux Distros Unpatched Vulnerability : CVE-2026-96284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the...

CVE-2026-84721 Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...

fast-uri: fast-uri: Security bypass due to inconsistent host case normalization

A flaw was found in fast-uri, a dependency-free URI parser. This vulnerability occurs because the software folds the host to lowercase before percent-decoding it, allowing percent-encoded uppercase characters to bypass this normalization. A remote attacker could exploit this by crafting a malicio...

CVE-2026-82368

Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches...

EUVD-2026-44813

9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding...

CVE-2026-71461

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

SUSE CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-18505

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to open redirect in the PMP HostHeaderFilter HostHeaderFilter.java:151. An unauthenticated attacker can craft a request with a manipulated Host header to redirect authenticated operators to attacker-controlled sites, enablin...

EUVD-2026-85353

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to open redirect in the PMP HostHeaderFilter HostHeaderFilter.java:151. An unauthenticated attacker can craft a request with a manipulated Host header to redirect authenticated operators to attacker-controlled sites, enablin...

CVE-2026-18505

IBM Financial Transaction Manager (FTM) for RedHat OpenShift versions 4.0.6.0 - 4.0.10.0 is vulnerable to an open redirect in the PMP HostHeaderFilter (HostHeaderFilter.java:151). An unauthenticated attacker can exploit this by crafting a request with a manipulated Host header , causing the appli...