UBUNTU-CVE-2026-74959

Mitigation bypass in the Storage: Cache API component. This vulnerabil...

UBUNTU-CVE-2026-23937

The Zabbix API host.get action can be exploited by authenticated users...

PT-2026-78742

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can execute arbitrary...

PT-2026-78778

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.9 Splunk Secure Gateway...

Linux Distros Unpatched Vulnerability : CVE-2026-74950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

UBUNTU-CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenti...

PT-2026-78482

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile validates an SVG filename extension but does not invoke Security::sanitizeSVG. An...

PT-2026-78397

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

PT-2026-78784

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user without an assigned role can execute arbitrary code by submitting a crafted file path to the Representational State Transfer REST API. This occurs because the REST API does...

CVE-2026-74959

Mitigation bypass in the Storage: Cache API component. This vulnerabil...

CVE-2026-74972

Information disclosure in the DOM: Push Subscriptions component. This...

UBUNTU-CVE-2026-74950

Privilege escalation in the Downloads API component. This vulnerabilit...

PT-2026-78352

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An issue exists where the 'stripeCharges' and 'payAuthorize' endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without...

PT-2026-78543

Name of the Vulnerable Software and Affected Versions ISPConfig affected versions not specified Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casti...

PT-2026-78740

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...

PT-2026-78737

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user possessing an embedded report token...

PT-2026-78450

Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference multiple frontend/API actions in J-BusinessDirectory 6.2.3...

PT-2026-78767

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description An unauthenticated user can trigger the reloading of token-signing keys via the Representational State Transfer REST API. This occurs because the REST API fails to require authenticati...

PT-2026-78797

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user with restricted tenant access can use the Representational State Transfer REST API to view the names and identifiers of tenants that are outside their assigned role scope...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...