EUVD-2026-49660

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

EUVD-2026-49667

Unauthenticated Server Side Request Forgery SSRF in Simple Link Directory Pro = 15.0.6 versions...

PT-2026-65625

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The multipart upload handler in the httpserver/updown.go file splits the part.FileName on the path separator but fails to reject the .. sequence. This allows an unauthenticated user to upload a file wi...

PT-2026-65551

Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A cross-tenant credential reuse issue exists in the streamable-HTTP stateless transport mode. This flaw may allow a Terraform token belonging to one user to be reused to execute tool cal...

PT-2026-65519

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...

Windows 11 24H2/25H2 | Server 2025 - Recovery Media Restore Fails with: The Local Security Authority cannot be contacted

Challenge When attempting to perform a restore using the Veeam Recovery Media, the restore fails while establishing the connection to the local VeeamAgent.exe process, and the following error occurs: The Local Security Authority cannot be contacted Because the failure occurs before a recovery...

Oracle Linux 10 : go-fdo-server (ELSA-2026-46395)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-46395 advisory. 1.0.1-3 - Rebuild against updated golang Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

PT-2026-65502

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

PT-2026-65600

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

PT-2026-65504

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

TencentOS Server 3: python3 (TSSA-2026:0766)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0766 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

RockyLinux 10 : go-fdo-server (RLSA-2026:46395)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:46395 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 crypto/x509: golang:...

OPENSUSE-SU-2026:11390-1 kubernetes1.35-apiserver-1.35.7-1.1 on GA media

These are all security issues fixed in the kubernetes1.35-apiserver-1.35.7-1.1 package on the GA media of openSUSE Tumbleweed...

TencentOS Server 2: ruby (TSSA-2026:0763)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0763 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TSIG packet with name compression can crash DNS

== Summary: Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. Description To calculate the size of a DNS packet region signed by a TSIG record, Samba's internal DNS server subtracted the presumed size of t...

TencentOS Server 3: .NET 8.0 (TSSA-2026:0770)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0770 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-65598

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...

PT-2026-65549

Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A server-side request forgery SSRF issue exists in the streamable-HTTP transport. This allows an unauthenticated remote client to redirect the server's Terraform API requests and the...

PT-2026-65578

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data...

ROS-20260728-73-0009

The vulnerability of the HTTP/2 header processing module in the Apache HTTP Server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...