CVE-2026-111915: Improper Limitation of a Pathname to a Restricted Directory

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

RHEL 7 : postgresql (RHSA-2026:84585)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84585 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

Amasty Order Attributes 3.16.0 Arbitrary File Upload

Amasty Order Attributes versions through version 3.16.0 contain an unauthenticated arbitrary file upload vulnerability. This proof of concept uploads supplied HTML content or, in full mode, PHP web shells. https://packetstorm.news/download/236358...

PT-2026-117639

Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache HTTP Server vulnerabilities (USN-8931-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8931-1 advisory. discovered that Apache HTTP Server exposed WebDAV property information. A remote...

CVE-2025-10149: Improper Preservation of Permissions

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including...

PT-2026-117464

Name of the Vulnerable Software and Affected Versions docTR versions prior to 1.1.1 Description An unsafe deserialization issue exists in the load pretrained params function. The function uses torch.load to load checkpoints without setting the weights only=True parameter. This allows an attacker...

PT-2026-117234

Name of the Vulnerable Software and Affected Versions bootc affected versions not specified Description An issue exists when using the default containers signature policy. During automatic or manual upgrades of a mutable image tag, unsigned content may be applied for registries that fall through ...

PT-2026-117254

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...

PT-2026-117249

Name of the Vulnerable Software and Affected Versions HPE Compute Scale-up Server 3200 affected versions not specified HPE Compute Scale-up Server 3250 affected versions not specified HPE Superdome Flex affected versions not specified HPE Superdome Flex 280 affected versions not specified...

PT-2026-117638

Name of the Vulnerable Software and Affected Versions Dell Application Store versions prior to 26.05.0.7 Description An Uncontrolled Path Element issue exists where a low privileged attacker with local access could potentially exploit the flaw to achieve Elevation of Privilege and execute arbitra...

CVE-2025-6623: Improper Neutralization of Input During Web Page Generation

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actio...

CVE-2026-111045: Improper Link Resolution Before File Access

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

Langflow 1.2.0 Code Injection

Langflow versions prior to 1.3.0 contain an unauthenticated code injection vulnerability in the /api/v1/validate/code endpoint. The supplied CTF lab recreates the vulnerable validation logic, and its proof of concept executes commands against the target to retrieve its flag...

Jenkins 2.426.2 LTS CLI Arbitrary File Read

Jenkins version 2.426.2 LTS contains an arbitrary file read vulnerability in CLI argument processing that can expose files readable by the Jenkins process. The supplied proof of concept retrieves CTF credentials through this issue. https://packetstorm.news/download/236352...

PT-2026-117395

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

CVE-2026-111058: Missing Authorization

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

RHEL 10 : mariadb11.8 (RHSA-2026:84799)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84799 advisory. MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation...

PT-2026-117666

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description Opening a specially crafted XCF file that selects a path and subsequently fails to load it can trigger a use-after-free condition in the main process. A use-after-free occurs when a program...

CVE-2026-94230: Missing Authorization

The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer...