PT-2026-52125

Name of the Vulnerable Software and Affected Versions ATEN Unizon affected versions not specified Description An issue in the ImportDeviceList method allows authenticated remote attackers to execute arbitrary code in the context of SYSTEM. This occurs due to insufficient validation of a...

PT-2026-52143

Name of the Vulnerable Software and Affected Versions Quest NetVault Backup affected versions not specified Description An authentication bypass issue exists within the 'viewclient' webpage due to improper validation of user-supplied data. This allows remote attackers to inject arbitrary scripts,...

PT-2026-51909

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the erofs component where the lcn variable was typed as unsigned long or unsigned int. On 32-bit platforms, this variable is only 32 bits wide, leading to the truncati...

PT-2026-52163

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.3 Description A Server-Side Request Forgery SSRF issue exists in the URL component located at src/lfx/src/lfx/components/data source/url.py. This is caused by a Time-of-Check/Time-of-Use TOCTOU race...

PT-2026-51934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A crafted filesystem can trigger an out-of-bounds bitmap walk in the Linux kernel. This occurs when OCFS2 IOC INFO is issued with OCFS2 INFO FL NON COHERENT. The issue stems from the ocf...

Zhengfang Software Co., Ltd.'s Zhengfang Academic Management System has a vulnerability regarding arbitrary file reading.

Positive Software Co., Ltd. hereinafter referred to as “Positive Company” was established in January 1999. It is a software and high-tech enterprise specialized in consulting, planning, construction, and services in the field of higher education informatization. Positive Software Co., Ltd. has a...

PT-2026-51886

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write occurs in the ADFS file system when processing a crafted image with a zero zone count. During boot block validation, if the nzones variable is 0, the adfs read map...

PT-2026-51660

Name of the Vulnerable Software and Affected Versions GeoVision GV-I/O Box 4E version 2.09 Description OS command injection flaws exist in the libNetSetObj.so internal library, which is used to configure the network stack. A remote attacker can execute arbitrary commands by sending a specially...

PT-2026-51933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ocfs2 module where the OCFS2 IOC GROUP ADD ioctl can trigger a kernel BUG ON. This occurs because the ocfs2 group add function calls ocfs2 set new buffer uptodate ...

pgAdmin 9.x < 9.16 Read-Only Transaction Bypass (CVE-2026-12045)

The version of pgAdmin installed on the remote host is 9.x prior to 9.16. It is, therefore, affected by a read-only transaction bypass vulnerability: - The AI Assistant's executesqlquery tool accepts multi-statement payloads. A single COMMIT followed by a write-statement terminates the enclosing...

Adobe ColdFusion < 2023.x < 2023u20 / 2025.x < 2025u9 Multiple Vulnerabilities (APSB26-64)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 20 or 2025.x update 9. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-64 advisory. - Improper Input Validation potentially leading to Arbitrary code execution...

PT-2026-52045

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.197 Description A use after free issue exists in the FileSystem component. This flaw allows a remote attacker to potentially exploit heap corruption, which occurs when a program continues to use a...

MINI-6WV2-Q74J-225R

Bulletin has no description...

MINI-JJF2-Q8HR-3H2P

Bulletin has no description...

MAL-2026-6349 Malicious code in bug-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdac6ea5e7530323f39451c43fc9e4693b30704a5f9e9287018c727a44c36a5d package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects hostname, username, home...

MAL-2026-6348 Malicious code in buffer-wrap-67d7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0192c1f2bf35c50a401e2df63f505564880339f5329c0ffcfdb8748cd6d48e3 The package declares a postinstall hook "postinstall": "node run.js" that executes run.js automatically on npm install. run.js imports os, fs, http,...

EUVD-2026-38592

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddresshost, port, which performs eager DNS name resolution fo...

CVE-2026-54514

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddresshost, port, which performs eager DNS name resolution fo...

MAL-2026-6346 Malicious code in triage-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef2bb10931626a345e1277463f9c2ec6ca36108c2d6131c9210707ea5692a64 package.json declares preinstall: node index.js, so the payload runs automatically on npm install with no user action. index.js requires os, fs, and...

CVE-2026-11819 Community.general: community.general keyring_info — os keyring passphrase returned in plaintext

Module: plugins/modules/keyringinfo.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module retrieves a passphrase from the OS native keyring GNOME Keyring, macOS Keychain, Windows Credential Manager and places it directly into result"passphrase" with no output suppression...