PT-2026-79066

Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

PT-2026-79214

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An issue exists in the cloud identity platform where the deserialization of untrusted data allows an unauthorized remote attacker to execute arbitrary code over the network. This...

PT-2026-79081

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl count and te count checks in the mg http parse and http cb paths in src/http.c accept bot...

PT-2026-79021

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Estonian Information System Authority RIA DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0...

PT-2026-79212

Name of the Vulnerable Software and Affected Versions Azure Arc affected versions not specified Description Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that...

TrueConf Server Missing Authentication for Critical Function Vulnerability

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script...

PT-2026-79261

Name of the Vulnerable Software and Affected Versions EverShop versions prior to 2.2.1 Description An authorization flaw exists in the customer update route. The route is incorrectly configured as public, allowing the admin authentication middleware to bypass caller verification. Additionally, th...

UBUNTU-CVE-2026-70906

Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

PT-2026-79113

An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 Multiple Vulnerabilities (MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00672, MMSA-2026-00675, MMSA-2026-00704 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin...

Linux Distros Unpatched Vulnerability : CVE-2026-71132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

UBUNTU-CVE-2026-65611

nnn does not sanitize the path variable. An attacker can createa direc...

PT-2026-80753

Name of the Vulnerable Software and Affected Versions Fleet affected versions not specified Description A SQL injection exists in the Okta conditional access integration. An attacker controlling a single enrolled host can provide a value via the host agent that is used in a database query without...

Linux Distros Unpatched Vulnerability : CVE-2026-71079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is 26.7.0. Easily exploitable...

PT-2026-79067

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition html, and partition md is fetched without host validation in...

OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls. HP has identified affected versions and the minimum version tha...

PT-2026-79046

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...

PT-2026-79116

Name of the Vulnerable Software and Affected Versions appwrite/templates affected versions not specified Description The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The verifyWebhook function in node/github-issue-bot/src/github.js and...

PT-2026-80770

Name of the Vulnerable Software and Affected Versions Wagtail versions prior to 7.0.9 Wagtail versions prior to 7.3.4 Wagtail versions prior to 7.4.3 Wagtail versions prior to 8.0rc2 Description The internal Pages admin API returns page fields declared in api fields without sufficient access...