PT-2026-103318

🚨 CVE-2026-100271 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects 🎖@cveNotify...

PT-2026-103544

Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description An authenticated administrator can set a configurable security-policy setting to a value exceeding the maximum permitted limit. This allows the associated security control to be rendered...

PT-2026-103578

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated administrator can force the server to send requests to and interact with internal network services that should not be accessible through the...

PT-2026-103065

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information...

PT-2026-103038

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...

PT-2026-103313

🚨 CVE-2026-100266 In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address 🎖@cveNotify...

CentOS Linux 7 [TuxCare] Security Update: libsss_idmap / libsss_simpleifp / libsss_simpleifp-devel / etc (CENTOS7:CLSA-2025:1748967240)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1748967240 advisory. - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...

PT-2026-103049

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

AlmaLinux 9.6 [TuxCare] Security Update: mod_dav_svn / python3-subversion / subversion / subversion-devel / etc (ALMALINUX9.6:CLSA-2026:1778495013)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778495013 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...

AlmaLinux 9.2 [TuxCare] Security Update: cyrus-imapd / cyrus-imapd-devel / cyrus-imapd-doc-extra / etc (ALMALINUX9.2:CLSA-2026:1779119949)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1779119949 advisory. - Cyrus IMAP before 3.8.3 and 3.10.x before 3.10.0-rc1 allows authenticated attackers to cause unbounded memory allocation by sending many...

PT-2026-103079

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...

PT-2026-103627

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload in the exceptions parameter. This...

CVE-2026-13224: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

PT-2026-103563

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description Insufficient validation of uploaded backup content allows an authenticated administrator to influence how the application loads the file. This could lead to arbitra...

CVE-2026-93547: Improper Authorization

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-102109: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitatio...

CVE-2026-102097: Improper Limitation of a Pathname to a Restricted Directory

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an authenticated administrator to import configuration whose contents were not sufficiently validated before being processed. A crafted submission could...

CVE-2026-102145: Improper Neutralization of CRLF Sequences

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...

CVE-2026-102142: Improper Neutralization of Special Elements Used in a Template Engine

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template that executed operating-system commands on the appliance...

CVE-2026-102140: Insufficient Verification of Data Authenticity

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...