CentOS Linux 8.5 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.5:CLSA-2026:1793098886)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793098886 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination...

Hitachi Energy RTU500 Missing Authentication for Critical Function (CVE-2026-8065)

An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integri...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS-STREAM8:CLSA-2026:1793098806)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1793098806 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destinati...

PT-2026-126613

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the pat...

PT-2026-126708

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-127184

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be...

PT-2026-127246

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading...

PT-2026-127255

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

PT-2026-126358

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex api package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

PT-2026-126318

Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02...

PT-2026-126319

Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02 throug...

PT-2026-126317

Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932:...

PT-2026-126320

OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-00 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-00 through 09-66/V; HiRDB Server Version 932: from 09-02 through...

PT-2026-127213

Name of the Vulnerable Software and Affected Versions Model Context Protocol Python SDK versions 1.10.0 through 1.29.1 Model Context Protocol Python SDK versions 2.0.0 through 2.1.1 Description Server-side bearer authentication configured through AuthSettings with token verifier fails to...

PLANET WGS-804HPT and WGS-4215 Missing Authentication for Critical Function (CVE-2025-46275)

PLANET WGS-804HPT V2 and WGS-4215-8P2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146328 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decodewatchers via missing bounds check cephstartdecoding validates that...

Linux Distros Unpatched Vulnerability : CVE-2026-116620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library...

Linux Distros Unpatched Vulnerability : CVE-2026-65629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recove...

Linux Distros Unpatched Vulnerability : CVE-2026-116195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146323 advisory. In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses ...