PT-2026-64169

Name of the Vulnerable Software and Affected Versions Johnson Controls CCure 9000 and victor application server versions 2.9 through 3.0 Description A Server Side Request Forgery SSRF issue exists in the Victor application server. SSRF is a flaw that allows an attacker to induce the server-side...

Security Bulletin: IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 (CVE-2026-11897)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details CVEID:CVE-2026-11897 DESCRIPTION: IBM WebSphere Application Server Liberty is...

SUSE CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

CVE-2026-7328

CVE-2026-7328 concerns Caliptra Core Runtime Firmware (2.1.0) and reports missing authorization in subsystem mode for INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands. This allows a privileged local attacker to trigger a denial-of-service via mailbox commands that con...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

Plone 2.5.x < 2.5.2 Multiple Vulnerabilities

The version of Plone installed on the remote host is 2.5.x prior to 2.5.2. It is, therefore, affected by the following vulnerabilities: - Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other...

PT-2026-63515

Name of the Vulnerable Software and Affected Versions Protegent 360 version 2.0.0.4 Description A local attacker can escalate privileges through the sub 186f4 function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-63514

Name of the Vulnerable Software and Affected Versions Protegent 360 version 2.0.0.4 Description A local attacker can escalate privileges through the pgsecdl.sys kernel driver. A kernel driver is a program that allows the operating system to communicate with hardware or perform low-level system...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

DEBIAN-CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

EUVD-2016-10909

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

CLEANSTART-2026-JR72966 Security fixes for CVE-2026-42504 applied in versions: 2.5.15-r2

Security vulnerability affects the fabric-peer package. This issue is resolved in later releases. See references for vulnerability details...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2754)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename whe...

CVE-2026-52476

CVE-2026-52476 affects aiflowy up to version 2.1.2. The vulnerability is a SQL Injection in getPageData (DatacenterQuery.java), enabling a remote attacker to obtain sensitive information. Documents consistently identify the flaw, but do not provide remediation details or exploit code. No explicit...

CVE-2026-52474

An issue in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on stream...

CVE-2026-56623 Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

MGASA-2026-0279 Updated nginx packages fix security vulnerabilities

ngxhttpproxyv2module and ngxhttpgrpcmodule vulnerability. CVE-2026-42055 ngxhttpcharsetmodule vulnerability. CVE-2026-48142...

CVE-2026-39385 Frappe LMS enrollment bypass in paid courses via unrelated batch

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...