PT-2026-119649

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: E1 Dev Platform Tech - UNIX. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards...

JFrog Artifactory < 7.133.21 / 7.146.x < 7.146.8 Privilege Escalation

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.133.21, or 7.146.x prior to 7.146.8. It is, therefore, affected by a privilege escalation vulnerability in event-handling. An authenticated, remote attacker can exploit this ...

PT-2026-120097

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in...

CentOS Linux 8 [TuxCare] Security Update: rsyslog / rsyslog-crypto / rsyslog-doc / rsyslog-elasticsearch / etc (CENTOS-STREAM8:CLSA-2026:1791954698)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1791954698 advisory. - A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript replace function...

Linux Distros Unpatched Vulnerability : CVE-2026-96224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96224 Note that Nessus relies on the presence of the packag...

Linux Distros Unpatched Vulnerability : CVE-2026-113495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper...

RockyLinux 9 : cockpit-files (RLSA-2026:84595)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:84595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Loc...

PT-2026-119650

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: E1 Dev Platform Tech - UNIX. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards...

CVE-2026-105453 IBM Sterling Connect:Direct for Unix Improper Privilege Management

IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management...

SUSE CVE-2026-111392

SGLang through 0.5.21 trusts caller-supplied mmhashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash via /generate to disclose another request's image content or...

SUSE CVE-2026-112074

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/matpixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

CVE-2026-98540

A flaw was found in the Linux kernel's function probe fprobe tracing component. This vulnerability can result in a Denial of Service DoS due to improper memory initialization. When tracing kernel functions, unused shadow stack space is left uncleared, causing return routines to parse leftover dat...

CVE-2026-112371

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclose...

CVE-2026-112372

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could...

CVE-2026-53995

A flaw was found in MLflow. An unauthenticated remote attacker can achieve arbitrary file write by submitting a crafted trace identifier containing path traversal sequences to the FileStore tracking backend. This vulnerability allows the attacker to write metadata files outside the intended...

CVE-2026-112358

A Server-Side Request Forgery (SSRF) vulnerability exists in TiBillet Lespass (up to version 10e87909c5d526dffa6d424c104fc12860740537). The flaw is located in the get_img_from_url function within the ApiBillet/serializers.py file of the APIv1 component. By manipulating the img_url or image_url ar...

CVE-2026-112358 TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112358 TiBillet Lespass APIv1 serializers.py get_img_from_url server-side request forgery

A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function getimgfromurl of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the argument imgurl/imageurl can lead to server-side...

CVE-2026-112297

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...