PT-2026-78449

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows...

PT-2026-78366

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated arbitrary file upload issue exists in the image element. The system accepts arbitrary files as long as the client-supplied Content-Type falls within the image MIME group Multipurpose...

PT-2026-78770

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Users without admin or power roles can execute arbitrary...

PT-2026-78411

Name of the Vulnerable Software and Affected Versions Renovate versions 39.218.0 through 40.32.0 Description The kustomize manager allows arbitrary command injection because user-provided chart names are appended to helm pull commands without proper sanitization. An attacker with repository write...

UBUNTU-CVE-2026-23938

An authenticated administrator is able to crash Zabbix server or proxy...

Linux Distros Unpatched Vulnerability : CVE-2026-11817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization...

Linux Distros Unpatched Vulnerability : CVE-2026-18692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to b...

Linux Distros Unpatched Vulnerability : CVE-2026-70906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allo...

EUVD-2026-62480

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modifie...

Linux Distros Unpatched Vulnerability : CVE-2026-18691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used...

Oracle MySQL ODBC Connector 26.7.0 < 26.7.1 (August 2026 CSPU)

The 26.7.0 versions of MySQL Connector/ODBC installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is...

PT-2026-78744

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can move files readable...

PT-2026-78441

Name of the Vulnerable Software and Affected Versions Dell Command Update versions prior to 5.7.1 Description An issue involving the deserialization of untrusted data allows a low privileged attacker with local access to escalate their privileges to SYSTEM level. Deserialization is the process of...

PT-2026-78757

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can trick an authenticated user int...

PT-2026-78446

Name of the Vulnerable Software and Affected Versions Cudy WR3000 2.0 versions prior to 2.5.24 Description The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge...

PT-2026-78477

Name of the Vulnerable Software and Affected Versions Dell Command Update DCU versions prior to 5.7.1 Description An Incorrect Authorization issue exists where a low privileged attacker with local access could potentially exploit the flaw to achieve Elevation of privileges. Recommendations Update...

PT-2026-78309

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a...

PT-2026-78773

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store a malicious script...

PT-2026-78694

Name of the Vulnerable Software and Affected Versions Termix versions prior to 2.6.1 Description An issue exists in the GET /host/db/host/:id/password endpoint within src/backend/database/routes/host.ts where host ownership is not enforced during credential resolution. When an authenticated user...

PT-2026-78331

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.15 Description An unauthenticated remote code execution RCE flaw exists, allowing an attacker to execute arbitrary code on the server without requiring authentication. Recommendations Update JetEngine to version...