CVE-2026-60000

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service resource consumption from excessive authentication attempts because MaxAuthTries was mishandled for GSSAPIAuthentication...

TP-Link Archer C5 has a cross-site scripting vulnerability (CNVD-2026-28254)

The TP-Link Archer C5 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer C5 has a cross-site scripting vulnerability. This vulnerability stems from insufficient server-side validation in the web management interface and improper control of user input...

Juniper Junos OS Vulnerability (JSA110077)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110077 advisory. - A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service DoS...

PT-2026-56664

Name of the Vulnerable Software and Affected Versions Drupal UI Patterns SDC in Drupal UI versions 2.0.0 through 2.0.17 Description An issue exists where the module does not sufficiently sanitize markup passed to components in certain scenarios, leading to Stored Cross-site Scripting XSS...

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

Joro's default proxy mode in versions = 1.1.0 exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScript on any page the operator visits can reac...

PT-2026-56624

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage...

Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage. HP has released updates to mitigate the potential vulnerabilities. HP has identified affected products with minimum versions that mitigate the potential vulnerabilities. See...

CVE-2026-47829 - Argument Injection in BOSH CLI Allows Local Command Execution on Operator Workstations via Compromised Director | Cloud Foundry

High CVSSv4: High 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 8.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. bosh-cli – All versions prior to v7.10.4 Description Argume...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-cxjq-mrr5-89rv Authentication Bypass via Path Traversal in ReplacePathRegex Middleware GHSA-42cj-m3vj-89wv CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass GHSA-qq9q-x9w4-chhj Gateway API...

PT-2026-56585

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.5 through 18.11.6 GitLab CE/EE versions 19.0 through 19.0.3 GitLab CE/EE versions 19.1 through 19.1.1 Description An issue exists where an authenticated user can create a repository where the content displayed in the w...

TP-Link Archer AX20 has a vulnerability related to input validation errors

The TP-Link Archer AX20 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer AX20 has a vulnerability related to input validation. This vulnerability stems from improper validation of URLs provided by users via the web interface. Attackers can exploit this...

PT-2026-56676

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 7.6.7 DSpace versions 8.0 through 8.3 DSpace versions 9.0 through 9.2 Description A path traversal issue exists in the curate script within the Curation Task feature. The reporter -r parameter, used to stream results a...

IBM Watsonx.Data Intelligence cross-site scripting vulnerability

IBM WatsonX.Data Intelligence is a data management and analysis platform provided by American company IBM. IBM WatsonX.Data Intelligence has a cross-site scripting vulnerability. Attackers can exploit this vulnerability to embed arbitrary JavaScript code in the Web UI, thereby altering intended...

CVE-2026-52200

An issue in Generic OEM UZ801v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk...

PT-2026-56914

Name of the Vulnerable Software and Affected Versions PAN-OS affected versions not specified Description A server-side request forgery SSRF issue in the management web interface allows an authenticated administrator with network access to perform unauthorized requests from the firewall to interna...

Linux Distros Unpatched Vulnerability : CVE-2026-14740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes...

Linux Distros Unpatched Vulnerability : CVE-2026-14739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did no...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16 / 11.2.x < 11.2.13 / 12.1.x < 12.1.8 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16, 11.2.x prior to 11.2.13, or 12.1.x prior to 12.1.8. It is, therefore, affected by a vulnerability. A file deletion vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacke...

PT-2026-56682

Name of the Vulnerable Software and Affected Versions Joro versions prior to 1.1.1 Description In default proxy mode, the software exposes a local API on 127.0.0.1:9090 that lacks authentication and implements a permissive wildcard CORS policy. Because multipart/form-data is a CORS-safelisted...

Linux kernel io_uring Heap Buffer Overflow DoS

The vulnerability of the ioopenatprep function in the iouring/openclose.c module, which is part of the Linux kernel’s asynchronous input/output interface, relates to the failure to release resources after their useful period has ended. Exploiting this vulnerability could allow an attacker to caus...