PT-2026-79080

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http cb function in src/http.c tests hm.proto.len with an...

PT-2026-79244

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...

PT-2026-79113

An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...

PT-2026-79214

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An issue involving the deserialization of untrusted data allows an unauthorized attacker to remotely execute code over a network. Deserialization is the process of converting a dat...

PT-2026-79195

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

UBUNTU-CVE-2026-70906

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

UBUNTU-CVE-2026-65611

nnn does not sanitize the path variable. An attacker can createa direc...

Linux Distros Unpatched Vulnerability : CVE-2026-71132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

TrueConf Server Missing Authentication for Critical Function Vulnerability

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script...

Linux Distros Unpatched Vulnerability : CVE-2026-71140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Oracle WebCenter Sites (August 2026 CSPU)

The 12.2.1.4.0 and 14.1.2.0.0 versions of WebCenter Sites installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported...

Linux Distros Unpatched Vulnerability : CVE-2026-71115

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

Oracle Java SE Denial of Service Vulnerability (August 2026 CSPU)

The 25.0.4 or 26.0.2 version of Java installed on the remote host is affected by a denial of service vulnerability as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle Java SE product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE...

Linux Distros Unpatched Vulnerability : CVE-2026-71079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is 26.7.0. Easily exploitable...

JetBrains YouTrack < 2026.1.13903 / 2026.2.x < 2026.2.17950 Information Disclosure (CVE-2026-75049)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.13903, or 2026.2.x prior to 2026.2.17950. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user could read restricted articles from other projects via the draft creation...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 Multiple Vulnerabilities (MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin...

PT-2026-78994

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

PT-2026-79060

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...

PT-2026-79044

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...