PT-2026-71231

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation of publish access for encrypted notebooks allows them to be treated as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document...

PT-2026-76561

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.87.0 Description The target search endpoint POST /api/latest/fleet/targets fails to sanitize data for users with Observer, Observer+, or Technician roles. This allows these users to retrieve unmasked team enroll secre...

PT-2026-71029

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-71217

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy configuration belonging to a namespace they were not authorized to access, due to incorrect...

PT-2026-76592

Name of the Vulnerable Software and Affected Versions Drupal Diff versions 0.0.0 through 2.0.1 Drupal Diff versions 2.1.0 through 2.1.1 Description An incorrect authorization issue allows forceful browsing. The module does not sufficiently restrict access to non-node entity revision diffs. This...

PT-2026-71242

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Authenticated readers or anonymous users when publish authentication is disabled can exploit missing publish-access filtering across multiple endpoints. The endpoint '/api/av/getAttributeViewKeysByID'...

PT-2026-71237

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An issue exists where the software fails to filter embedded block content based on publish access permissions. While the initial requested block is checked for authorization, blocks pulled in via embe...

Linux Distros Unpatched Vulnerability : CVE-2026-73213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addrlesseq in src/client/nsturnioaddr.c uses a component-wise comparison f...

PT-2026-71142

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

PT-2026-71064

Name of the Vulnerable Software and Affected Versions FortiManager version 7.6.1 FortiManager versions 7.4.3 through 7.4.5 FortiManager versions 7.2.5 through 7.2.9 FortiManager Cloud version 7.6.1 FortiManager Cloud versions 7.4.3 through 7.4.5 FortiManager Cloud versions 7.2.5 through 7.2.9...

PT-2026-70964

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy file range source with src mounter creds Commit 5dae222a5ff0c "vfs: allow copy file range to copy across devices" allowed filesystems that implement the copy file range f op to decide if they want to...

PT-2026-71092

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluates the ForAllValues: and ForAnyValue: set qualifiers with the negated string operators StringNotEquals, StringNotEqualsIgnoreCase, StringNotLike, ArnNotEquals, and ArnNotLike using each other's...

PT-2026-71043

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

PT-2026-71238

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description An access control bypass exists in the server mux where several static-file routes bypass the publish-access controls enforced on the REST API. This allows attackers with publish reader tokens or...

Cisco IOS XE Software Security Hardening Release: August 2026 (cisco-sa-hardening-iosxe-V8NMuMZJ)

According to its self-reported version, Cisco IOS-XE Software is affected by multiple vulnerabilities. - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review...

Debian dsa-6434 : lemonldap-ng - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6434 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2025-31938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient granularity of access control in some subsystem for some IntelR XeonR 6 Scalable processors with IntelR TDX may allow an information disclosure...

Linux Distros Unpatched Vulnerability : CVE-2026-68448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovl: check access to copyfilerange source with src mounter creds Commit 5dae222a5ff0c vfs: allow copyfilerange to copy across devices allowed filesystems that...

DEBIAN-CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

UBUNTU-CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...