PT-2026-51706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the batman-adv module. When a batadv hard iface is disabled, its mesh iface pointer is set to NULL. The function batadv v ogm send meshif may still...

CVE-2025-60474

The GPAC Project/MP4Box packaging tool (versions prior to 26.02.0 ) is vulnerable to a buffer overflow in the gf_media_import function located in /media_tools/av_parsers.c. An attacker can exploit this by providing a specially crafted input signal to cause a Denial of Service (DoS) . While some d...

PT-2026-51820

Name of the Vulnerable Software and Affected Versions OpenText Access Manager versions 5.1 through 5.1.2 Description Improper neutralization of input during web page generation allows Cross-Site Scripting XSS, a condition where malicious scripts are injected into trusted websites. Recommendations...

Linux Distros Unpatched Vulnerability : CVE-2026-9595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: When a user-configured proxy on webpack-dev-server has a broad context e.g. / and ws: true, it also intercepts the dev server's own HMR WebSocket and...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache MINA vulnerabilities (USN-8465-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8465-1 advisory. It was discovered that Apache MINA lacked an acceptMatchers allowlist mechanism to restrict which classes could be deserialized. ...

Linux Distros Unpatched Vulnerability : CVE-2026-9539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds heap read and integer underflow in the TCP urgent data handling sosendoob in freedesktop.org libslirp version before v4.9.2 on hypervisor host...

TencentOS Server 3: php:8.2 (TSSA-2026:0547)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0547 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-52073

Name of the Vulnerable Software and Affected Versions Ghost versions 5.46.1 through 6.21.1 Description Validation applied to filters on public API endpoints could be partially bypassed, allowing the disclosure of private fields through a brute force attack. The impact varies by database: when usi...

Oracle Linux 9 : php:8.2 (ELSA-2026-22143)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22143 advisory. php 8.2.31-1 - rebase to 8.2.31 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040...

Linux Distros Unpatched Vulnerability : CVE-2025-61022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in the sqlotbcolpreds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

MINI-5R94-R25V-WQH2

Bulletin has no description...

MINI-RV7F-52HP-67MM

Bulletin has no description...

MINI-2P8C-V54C-JGC5

Bulletin has no description...

GHSA-6X4J-8954-5HXM Snipe-IT has a 2FA reset privilege bypass

Impact A user who can edit other users could reset a superadmin's 2FA. Patches Patched in 8.5.0...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization via the 2FA reset process. An attacker can gain unauthorized access to privileged accounts by resetting two-factor authentication for higher-privileged...

Snipe-IT has a 2FA reset privilege bypass

Impact A user who can edit other users could reset a superadmin's 2FA. Patches Patched in 8.5.0...

Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Impact POST /two-factor had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guesses. The TOTP implementation accepts the current code plus one step on either side config/google2fa.php window=1, so at any instant 3 of 1,000,000 codes are...

Allocation of Resources Without Limits or Throttling

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the POST /two-factor process. An attacker can gain unauthorized access to user accounts by submitting unlimited TOTP...

GHSA-MR8G-2MJ4-PCQ2 Snipe-IT's TOTP is Brute-Forceable Due to Missing Rate Limiting on `POST /two-factor`

Impact POST /two-factor had no rate limiting, lockout, or attempt counter. An attacker with valid credentials can submit unlimited TOTP guesses. The TOTP implementation accepts the current code plus one step on either side config/google2fa.php window=1, so at any instant 3 of 1,000,000 codes are...

CVE-2026-47693 Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 are vulnerable to CSV Injection Formula Injection in its log export functionality. User-controlled data — specifically the username field — is written to exported CSV files without sanitizing...