CVE-2026-90867: Progress Software WS_FTP Server: Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper access control in the Web Admin console of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts...

CVE-2026-93680: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication...

CVE-2026-115708: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…

Improper Link Resolution Before File Access 'Link Following' CWE-59 in Elastic Cloud Enterprise ECE can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack CAPEC-132...

CVE-2026-85498: Red Hat: A flaw was found in polkit

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigge...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146973)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146973 advisory. A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the en...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mongo-c-driver (UTSA-2026-146976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146976 advisory. A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce...

PT-2026-132327

Name of the Vulnerable Software and Affected Versions Progress Software WS FTP Server versions prior to 2024.0.6 Progress Software WS FTP Server versions prior to 2025.0.3 Description Improper authentication on Windows allows an unauthenticated remote attacker to access sensitive information,...

PT-2026-132330

Improper authentication in the Web Transfer Module of Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

CVE-2026-84295: Progress Software WS_FTP Server: Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could…

Improper authentication in Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials...

CVE-2026-90862: Progress Software WS_FTP Server: Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

Linux Distros Unpatched Vulnerability : CVE-2026-118264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before...

AlmaLinux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1793296709)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793296709 advisory. - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating...

Linux Distros Unpatched Vulnerability : CVE-2026-118681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted...

Linux Distros Unpatched Vulnerability : CVE-2026-116794

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's...

PT-2026-132835

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching sha2 password authentication, the authentication-more-data response was treated as a length-encoded byte array, memory was allocated from the...

ALSA-2026:92368 Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized...

ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

Important: curl security, bug fix, and enhancement update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-8932 curl: libcurl: Unauthorized...

ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing CVE-2026-101911 brace-expansion: brace-expansion: Denial of Service v...

ALSA-2026:92869 Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65182 tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve N...