PT-2026-66753

Name of the Vulnerable Software and Affected Versions gnome-remote-desktop as shipped in Red Hat Enterprise Linux affected versions not specified Description A flaw exists when the daemon operates in system mode with RDP enabled. The incoming connection handler bypasses the connection throttler,...

PT-2026-66835

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

GitLab 11.8 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-15975)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

IBM App Connect Enterprise information leakage vulnerability (CNVD-2026-31544)

IBM App Connect Enterprise is an enterprise-level application connection platform used for system integration. It supports connections and conversions between applications, data, and APIs. There is an information leakage vulnerability in IBM App Connect Enterprise. This vulnerability stems from t...

PT-2026-66678

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description An unauthenticated remote attacker can read image-decodable files and enumerate host paths. The get model preview function in app/model manager.py uses os.path.joinfolder, filename with an...

FreeBSD : NetBird -- Local Privilege Escalation via Unauthenticated IPC Socket (ef71114e-8c1c-11f1-a221-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the ef71114e-8c1c-11f1-a221-3c7c3fba4204 advisory. The NetBird Team reports: The NetBird client daemon exposes its gRPC control interface to any local...

IBM Langflow OSS command injection vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications through drag-and-drop components. Additionally, it supports deep customization using Python to integrate...

PT-2026-66747

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...

PT-2026-66778

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

PT-2026-66714

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

PT-2026-66853

Name of the Vulnerable Software and Affected Versions Coturn versions 4.5.2 through 4.14.0 Description When started with the --acme-redirect parameter and exposing a plaintext-TCP listener, an unauthenticated remote client can send an HTTP GET request to trigger a memory leak. The server responds...

Linux Distros Unpatched Vulnerability : CVE-2026-11770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extend...

Cisco Secure Firewall Management Center Software Static Credentials (cisco-sa-fmc-static-cred-BET3Cjh)

A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a static, low-privileged account and access sensitive data within the impacted system. This vulnerability is due to th...

GitLab 8.8 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-14351)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

CVE-2026-66421 OpenClaw Dashboard Stored XSS via lastMessage Session Field

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

CVE-2026-66420

MeshCentral 1.1.21 is affected by a cross-site WebSocket hijacking vulnerability caused by an unconditional early return in CheckWebServerOriginName() in webserver.js when using self-signed certificates. This allows unauthenticated remote attackers to initiate cross-origin WebSocket connections t...

CVE-2026-66420 MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...