PT-2026-70311

Improper authentication in the IntelR TDX module for some IntelR platforms within Ring 0: Trust Domain may allow an information disclosure and escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This...

PT-2026-70130

Name of the Vulnerable Software and Affected Versions Peppermint Lab Peppermint versions through commit ba6e217 Description Broken access control occurs because the Config.roles active flag defaults to false, which causes permission checks on ticket, client, and user handlers to behave as no-ops...

PT-2026-70135

Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0 Description An authenticated user can perform a server-side request forgery SSRF because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL'...

PT-2026-70293

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software affected versions not specified Description Improper authentication within Ring 0 the most privileged level of the CPU of the kernel may allow an information disclosure. A system software adversary with...

PT-2026-70427

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70434

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70110

A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remote attackers to mint Stripe Billing Portal sessions for any tenant via the stripeCustomerPortal GraphQL mutation. The mutation performs no authentication or authorization checks before creating a...

PT-2026-70108

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before...

PT-2026-70414

Name of the Vulnerable Software and Affected Versions Microsoft Windows Search Component affected versions not specified Description Weak authentication in the Microsoft Windows Search Component allows an authorized attacker to disclose sensitive information locally, which can affect the system...

PT-2026-70158

FreeRDP before 3.30.0 contains an out-of-bounds vulnerability in kerberos DecryptMessage winpr/libwinpr/sspi/Kerberos/kerberos.c. The 16-bit EC extra count field of a peer-supplied GSS Wrap token RFC 4121 is used directly in pointer arithmetic to locate the encrypted regions without being...

(Pwn2Own) Microsoft Exchange Capture-Replay Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Microsoft Exchange. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of authentication requests. The issue results from using an alternative,...

PT-2026-70598

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2016 Microsoft Exchange Server 2019 Microsoft Exchange Server Subscription Edition Description An authentication bypass by capture-replay allows an authorized attacker to elevate privileges over a network. The issue...

Joomla JCE 2.9.99.4 Remote Code Execution

The JCE Joomla Content Editor profile import functionality lacks proper authentication and CSRF protections. An unauthenticated attacker can upload a crafted XML file containing PHP code; the file is stored in the /tmp/ directory and can be accessed via HTTP, leading to remote code execution...

ALSA-2026:53844 Important: iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol IP networks...

RHEL 10 : iscsi-initiator-utils (RHSA-2026:53845)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53845 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as t...

Security Updates for Microsoft SharePoint Server 2016 (August 2026)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. CVE-2026-62827 -...

2026.3 IPU,  Intel® Trust Domain Extensions (Intel® TDX) module Advisory

Summary: Potential security vulnerabilities for some Intel® TDX modules may allow information disclosure, escalation of privilege, or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2026-20885 Description:...

Security Updates for Microsoft SharePoint Server 2019 (August 2026)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. CVE-2026-62827 -...

ALSA-2026:53845 Important: iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol IP networks...

PT-2026-70170

n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenticated users to bypass SSRF protections. Attackers can craft workflows that send requests to internal or blocked hosts without routing through SSRF protection...