PT-2026-103032

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-94274: Exposure of Sensitive Information to an Unauthorized Actor

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

EUVD-2026-90414

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...

CVE-2026-55177: Server-Side Request Forgery (SSRF)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

VulnCheck KEV: CVE-2024-58387

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

PT-2026-103194

Name of the Vulnerable Software and Affected Versions SiteSkite versions prior to 2.2.0 Description An unauthenticated remote code execution issue exists due to a critical chain involving API-key autologin and the eval function within the MCP component. This allows an attacker to execute arbitrar...

CVE-2026-51867

The software agentgpt v.1.0.0 is vulnerable to Incorrect Access Control within the next/src/server/api/routers/agentRouter.ts component. The issue stems from an externally reachable path that accepts a caller-selected object or tenant identifier, allowing it to perform data-access operations with...

AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1775646020)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1775646020 advisory. - Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication formerly...

CentOS Linux 8.5 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1778087756)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1778087756 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11-urllib3 Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1770035896)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1770035896 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the...

AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1772812307)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772812307 advisory. - The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions: action. As a result, a...

Linux Distros Unpatched Vulnerability : CVE-2026-13719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11-urllib3 Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1770046658)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1770046658 advisory. - urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the...

CentOS Linux 8 [TuxCare] Security Update: systemd / systemd-container / systemd-devel / etc (CENTOS-STREAM8:CLSA-2026:1784813417)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1784813417 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with...

Linux Distros Unpatched Vulnerability : CVE-2026-13720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard...

PT-2026-103121

Name of the Vulnerable Software and Affected Versions Claude Code versions 2.0.68 through 2.1.259 Description Claude Code prioritized a locally stored API key, such as one from a previous /login or configuration file, over a valid Claude Enterprise or Team sign-in when retrieving server-managed...

PT-2026-103617

Name of the Vulnerable Software and Affected Versions DB-GPT version 0.8.0 Description The sandbox API silently falls back to LocalRuntime, which allows for the execution of arbitrary code on the host system. Recommendations At the moment, there is no information about a newer version that contai...