PT-2026-121675

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The default JWTBearerGrant.get audiences function returns an empty list, which leads JWTBearerGrant.verify claims to only check for the existence of an aud claim without verifying if it matches the...

CrowdStrike Channel File 291: An Engineering Analysis of a Global Endpoint Outage

On July 19, 2024, a CrowdStrike Falcon content update caused Windows systems to crash, affecting about 8.5 million devices according to a Microsoft estimate. The immediate defect was an inconsistency between a detection template that declared 21 inputs and sensor code that supplied 20. A new...

PT-2026-121507

Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and...

PT-2026-121282

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14...

PT-2026-121297

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142559)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142559 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because, when renewing tokens issued by the Kubernetes Auth method, it fails to verify whether the originally used service account token remains valid. As a resul...

hwk-fr ACF Extended authorization issue vulnerability

The hwk-fr ACF Extended versions 0.9.2.7 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

PT-2026-121549

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3 access and secret keys, then read...

Linux Distros Unpatched Vulnerability : CVE-2026-80353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Time-of-check time-of-use TOCTOU race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-91402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JavaFX. Supported versions that are...

Linux Distros Unpatched Vulnerability : CVE-2026-101774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Serve...

ABB Ability Edgenius authorization issue vulnerability

ABB Ability Edgenius versions 3.2.3.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, potentially allowing unauthorized access to these functions...

PT-2026-120931

Name of the Vulnerable Software and Affected Versions Traefik version 3.7.13 Description An access-control bypass exists in the Kubernetes Ingress NGINX provider. The HTTP router created for ssl-passthrough Ingresses on non-TLS entry points fails to apply access-control annotations. This allows...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142508)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142508 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offse...

Oracle MySQL Connectors J (October 2026 CPU)

The versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. The supported version that is affected is 26.7.0. Difficul...

Windows kernel Unauthorized Access

The vulnerability of Windows operating system kernels relates to the exposure of system data to unauthorized individuals. Exploiting this vulnerability can allow a perpetrator to gain unauthorized access to protected information...

rdpecam module RDP Client Unauthorized Access

The vulnerability of the rdpecam module in the RDP client FreeRDP is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by sending a specially crafted request...

Cisco ISE Policy Runtime Repository Table Unauthorized Access

The vulnerability of the Policy Runtime Repository Table PRRT service on the Cisco Identity Services Engine ISE network management platform, as well as the Cisco ISE Passive Identity Connector ISE-PIC virtual authentication device, is related to the absence of authentication for a critical...

Microsoft Access Code Execution

The vulnerability of Microsoft Access database management systems, as well as Microsoft Office and 365 Apps for Enterprise applications, is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...