PT-2026-125544

A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely...

ROS-20261027-73-0011

The vulnerability in the kbdintnextdevice function within the sshd service of the OpenSSH cryptographic suite is related to access control flaws in handling the oKbdInteractiveDevices parameter, which contains a list of methods for authenticating via an interactive keyboard. Exploitation of this...

ROS-20261027-73-0005

The vulnerability in the mmanswerpamfreectx function of the OpenSSH cryptographic library is related to privilege management errors. Exploitation of this vulnerability could allow an attacker to execute arbitrary code or shut down the sshd service...

PT-2026-126373

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

PT-2026-127750

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

PT-2026-126411

A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended t...

PT-2026-126413

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional guests field when guests are disallowed. Attackers can set additional guests to the remaining seat count in modules/events/events...

ROS-20261027-73-0088

The EaxDecrypt function vulnerability in Wireshark’s computer network traffic analyzer is related to a buffer overflow in dynamic memory. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

Linux Distros Unpatched Vulnerability : CVE-2026-65630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erla...

Linux Distros Unpatched Vulnerability : CVE-2026-116259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afcgetdeviceinfokey of the file src/afc.c of the...

Linux Distros Unpatched Vulnerability : CVE-2026-65628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when bot...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146144)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146144 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before...

CentOS Linux 8 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1793091465)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1793091465 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the libra...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146267)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146267 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd ipvs: avoid kmemcachezalloc i...

CentOS Linux 8.4 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793102654)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793102654 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library...

CentOS Linux 8.5 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1793103045)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793103045 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library...

PT-2026-126442

A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely...

PT-2026-125899

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode membership check facebook user AJAX action. This is due to a typographic error in the Facebook OAuth token verification guard with...

PT-2026-125552

DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq libmpq file number from hash function that allows attackers to read heap memory via unchecked block table index values. Attackers can place a crafted .mpq archive in the game's data path, such as a...

ROS-20261027-73-0003

The vulnerability in the resendbytes function roamingcommon.c of the OpenSSH cryptographic library is related to errors in managing cryptographic keys. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information...