CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-59686

Technical details for CVE-2026-59686 are not publicly available in the provided documents; monitor for updates from vendors for affected products and fixes.

Vulnerabilities Fixed in SolarWinds Serv-U

SolarWinds has addressed several vulnerabilities in Serv-U. The vulnerabilities in SolarWinds Serv-U primarily involve insecure direct object reference IDOR and broken access control. These vulnerabilities allow attackers with certain privileges—such as domain administrator or group administrator...

CVE-2026-16400

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: Security component...

CVE-2026-16394

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Security component...

CVE-2026-16366

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...

CVE-2026-16365

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Workers component...

PT-2026-64901

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

PT-2026-64906

Name of the Vulnerable Software and Affected Versions GNU Binutils affected versions not specified Description A heap-buffer-overflow read occurs in the linker when processing a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker can provide a malicious file...

CVE-2026-59687: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...

PT-2026-64903

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress Software ECS Connection Manager affected versions not specified Progress Software Object Scale Connection Manager affected versions not specified Progress Software MOVEit WA...

CVE-2026-59689: Incorrect Authorization

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system...

CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

CVE-2026-59688: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

PT-2026-64894

Forensic Master Report: API and GPS Infrastructure Interference 1. Threat Actor Identification and Landscape Forensic telemetry identifies a multi-tiered adversarial campaign characterized by a sophisticated coordination between institutional actors and Advanced Persistent Threat APT groups. The...

PT-2026-64934

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

CVE-2026-59686: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

PT-2026-65305

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the DeleteNotificationController::delete method at the GET /notification/delete/id endpoint. This flaw allows any authenticated us...

PT-2026-64982

Name of the Vulnerable Software and Affected Versions sqlite version 3.41 Description A use-after-free issue exists in the JSON extraction function. The problem occurs when the program continues to access internal members of a freed pointer after the JsonParse object memory has been released via...

CVE-2026-15003: Out-of-bounds Read

A flaw was found in the GNU Binutils Binary Utilities linker. This vulnerability, a heap-buffer-overflow read CWE-125, occurs when the linker processes a specially crafted 32-bit XCOFF Extended Common Object File Format object file. An attacker could exploit this by providing a malicious file,...