Linux Distros Unpatched Vulnerability : CVE-2026-48551

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An...

PT-2026-71503

Unauthenticated Privilege Escalation in MStore API = 4.20.0 versions...

PT-2026-71875

Name of the Vulnerable Software and Affected Versions AgenticSeek version fc242c7 Description An unauthenticated remote code execution issue exists that allows network-adjacent attackers to execute arbitrary commands. By submitting crafted queries to the unprotected 'POST /query' API endpoint, an...

PT-2026-71598

Unauthenticated Sensitive Data Exposure in KiviCare = 4.5.1 versions...

PT-2026-71546

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

PT-2026-71383

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS affected versions not specified Description An information disclosure issue exists within the URL Filtering feature of the software. This flaw allows an unauthenticated user with network access to retrieve sensitive...

PT-2026-71514

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

PT-2026-71583

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

PT-2026-71679

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description An issue exists in the Zimbra Briefcase document editing functionality where the packages parameter is not properly validated. An authenticated attacker can use a crafted path...

PT-2026-71664

Name of the Vulnerable Software and Affected Versions rsync daemon versions 2.0.0 through 3.4.9 Description A denial of service issue exists that allows unauthenticated remote attackers to exhaust daemon connection slots. This is achieved by stalling the handshake process either before or after...

PT-2026-71925

Name of the Vulnerable Software and Affected Versions OpenChoreo versions prior to 1.0.3 OpenChoreo versions prior to 1.1.3 OpenChoreo versions prior to 1.2.0-rc.2 Description The internal/cluster-gateway/server.go component exposes the '/api/proxy/', '/api/exec/', and '/api/wirelogs/' endpoints ...

PT-2026-71470

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 16.0 through 16.14 PostgreSQL versions 17.0 through 17.10 PostgreSQL versions 18.0 through 18.4 Description A discrepancy in the responses of the SCRAM authentication subsystem allows an unauthenticated remote attacker to...

CVE-2026-67990

Technical details are not publicly available in the provided documents; monitor for updates.

PT-2026-71542

Name of the Vulnerable Software and Affected Versions SAML SP Single Sign On versions prior to 5.4.4 Description An unauthenticated privilege escalation flaw allows attackers to sign in as any WordPress user, including administrators. Recommendations Update to a version newer than 5.4.3...

PT-2026-71557

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

PT-2026-71512

Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...

PT-2026-71551

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce via CLINK = 1.0.7 versions...

VulnCheck KEV: CVE-2026-26190

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath...

VulnCheck KEV: CVE-2025-55583

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a preapiarg parameter that is passed directly to system-level shell execution functions without...

Alibaba Cloud Linux 3 : 0248: java-17-openjdk (ALINUX3-SA-2026:0248)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0248 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-66293: LIBPNG is a reference...