PT-2026-79461

Name of the Vulnerable Software and Affected Versions Atlantis versions 0.19.8 through 0.44.0 Description Atlantis fails to consistently validate user-controlled workspace values provided via the repository-level atlantis.yaml configuration or the authenticated '/api/plan' endpoint before joining...

PT-2026-79498

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102033 advisory. In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Vulnerability (ESA-2026-94)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, 9.0.x prior to 9.3.6, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-94 advisory. - Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of...

Linux Distros Unpatched Vulnerability : CVE-2026-68554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an...

SUSE SLES15 Security Update : erlang (SUSE-SU-2026:3645-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3645-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...

Linux Distros Unpatched Vulnerability : CVE-2026-63385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...

Linux Distros Unpatched Vulnerability : CVE-2026-32791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted search path for some IntelR Performance Counter Monitor IntelR PCM before version tag 202604 within Ring 3: User Applications may allow an escalation ...

Linux Distros Unpatched Vulnerability : CVE-2026-63380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error pat...

PT-2026-79397

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...

PT-2026-79492

Name of the Vulnerable Software and Affected Versions LeafWiki versions 0.3.0 through 0.10.0 Description LeafWiki contains a path traversal flaw within the asset rename functionality. This issue occurs because the application fails to properly sanitize user-supplied file paths during the rename...

PT-2026-79392

is path trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparent path, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allow...

PT-2026-79352

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:3649-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3649-1 advisory. - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. -...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102050)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102050 advisory. In the Linux kernel, the following vulnerability has been resolved: RDMA/vmwpvrdma: Fix double free on pvrdmaallocucontext error path Sashiko points out that...

openSUSE 16 Security Update : python-unearth (openSUSE-SU-2026:21606-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21606-1 advisory. Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass...

PT-2026-79964

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run id or model id after validate source run or validate source model in mlflow/server/handlers.py verifies only path containment, allowin...

PT-2026-79360

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

PT-2026-79378

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files...

PT-2026-79370

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an...