PT-2026-85069

An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated party able to supply a sufficiently larg...

PT-2026-85298

Name of the Vulnerable Software and Affected Versions MOOS-IvP pMarineViewer versions prior to 24.8.2 Description An issue exists where the software fails to limit the number of tracked node identities received from NODE REPORT messages. An unauthenticated attacker can publish crafted NODE REPORT...

PT-2026-85119

Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...

PT-2026-85123

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

PT-2026-85072

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description A memory-handling error exists in the BSON-to-JSON conversion helpers. This issue occurs when a binary field is encoded and the output is truncated at a length limit configured by th...

PT-2026-85068

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description A double free occurs in the OpenSSL-based TLS certificate revocation checking path. This issue is triggered during the handshake process when a TLS endpoint trusted by the client sen...

PT-2026-85290

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description An issue exists where the software fails to validate that serialized string lengths are non-negative within the CMOOSMsg::operator function. Unauthenticated attackers can exploit this by...

PT-2026-85291

Name of the Vulnerable Software and Affected Versions MOOS core-moos versions prior to 10.4.1 Description An issue exists where the software fails to validate packet length declarations in the CMOOSCommPkt::OnBytesWritten function. This allows unauthenticated attackers to trigger unbounded buffer...

PT-2026-85248

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.2.0 Description A remote unauthenticated attacker can cause a denial of service in Node.js applications by providing a specially crafted TOML document. The toml.parse function uses a recursive-descent parser that...

PT-2026-85039

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal...

PT-2026-85206

WHMCS shipped 9.0.8 and 8.13.7 for CVE-2026-67399 — an unauthenticated flaw where forged payloads can lead to remote code execution and full compromise of the installation. https://t.co/ylc61G42CO...

Linux Distros Unpatched Vulnerability : CVE-2026-73270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected...

Linux Distros Unpatched Vulnerability : CVE-2026-66835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixin...

Linux Distros Unpatched Vulnerability : CVE-2026-65139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - slurm-wlm - None Ubuntu Linux - Fix various issues in unsafe operation/queries to the slurmdbd CVE-2026-65139 Note that Nessus relies on the...

PT-2026-85092

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-71380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servic...

VulnCheck KEV: CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1...

Oracle Linux 10 : ELSA-2026-61680-0: / iperf3 (ELSA-2026-616800)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-616800 advisory. - Fix JSON value bounds checks in getparameters and iperfparsearguments CVE-2026-71217 Tenable has extracted the preceding description block directly from th...

apptainer-1.5.3-3.1 on GA media (moderate)

apptainer-1.5.3-3.1 on GA media Announcement ID: openSUSE-SU-2026:11664-1 Rating: moderate Cross-References: CVE-2026-41178 CVSS scores: CVE-2026-41178 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

PT-2026-85374

Name of the Vulnerable Software and Affected Versions IXON VPN Client versions prior to 1.4.7 Description An improper CRLF Carriage Return Line Feed sequence neutralization flaw allows unauthenticated local attackers to execute commands with root or SYSTEM privileges. The issue exists in a...