PT-2026-92100

Name of the Vulnerable Software and Affected Versions gitoxide gix-transport versions prior to 0.59.2 Description The software fails to filter control characters in git-daemon connect requests. This allows attackers to inject NUL, CR, or LF bytes through specially crafted git URLs. Such injection...

PT-2026-91890

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf node activate ex of the file scenegraph/base scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly...

CVE-2026-86472: Improper Handling of Case Sensitivity

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...

CVE-2026-76684: Improper Authentication

Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading ...

PT-2026-93173

@zereight/mcp-gitlab exposes its Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those...

CVE-2026-87269: Improper Privilege Management

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

PT-2026-93122

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description The guest-to-host Unix-domain socket relay in Docker Sandboxes contains a flaw where it validates that a socket path is within an authorized workspace but subsequently reconnects usi...

PT-2026-91922

Name of the Vulnerable Software and Affected Versions fast-uri versions prior to 2.4.7 fast-uri versions 3.0.0 through 3.1.7 fast-uri versions 4.0.0 through 4.1.4 Description The software folds the host to lowercase before percent-decoding it. Consequently, a percent-encoded uppercase octet, such...

Linux Distros Unpatched Vulnerability : CVE-2026-91986

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafted...

PT-2026-99160

Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboard host setting is empty. In that configuration, /api/v1/oauth2/provider again reflects the request Host header into the OAuth2 redirect uri sent to the identity provider, even if...

CVE-2026-87271: Improper Privilege Management

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

PT-2026-93088

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system...

PT-2026-93090

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system...

CVE-2026-54167: Insufficient Verification of Data Authenticity

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

PT-2026-93217

Name of the Vulnerable Software and Affected Versions Podman affected versions not specified Description An issue exists where an attacker can create arbitrary files on the host machine with the privileges of the user running the software. This occurs when a specially crafted tar archive is...

CVE-2025-11395: Insecure Inherited Permissions

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

Linux Distros Unpatched Vulnerability : CVE-2026-86472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 throu...

PT-2026-99718

Name of the Vulnerable Software and Affected Versions Nezha version 2.2.3 Description Nezha contains a Host header injection issue in the OAuth2 redirect endpoint. When the optional dashboard host setting is empty, the application reflects the attacker-supplied HTTP Host header into the redirect...

CVE-2026-57141: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

PT-2026-92085

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description An unauthenticated server-side request forgery SSRF issue exists in the check site availability function. This occurs because the function accepts attacker-controlled HTTP Host headers. By sending...