359661 matches found
RHEL 10 : php8.4 (RHSA-2026:56969)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56969 advisory. PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also...
PT-2026-78480
Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0 Description A path traversal issue exists in the EDI archive restore function. The archrestore sel POST parameter is processed by the archive restore handler without proper sanitization for path traversal...
PT-2026-78554
Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a header parameter default is emitted int...
EUVD-2026-62482
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the apivedo/chat endpoint and the utentechat parameter...
PT-2026-78420
Name of the Vulnerable Software and Affected Versions Stigmem versions prior to 0.9.0a11 Description Authenticated users can perform blind Server-Side Request Forgery SSRF attacks by specifying internal loopback or private network destinations in the delivery address parameter during the creation...
PT-2026-78571
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin user create cus AJAX handler lacking any authenticatio...
When Agents Go Rogue: The OpenClaw Supply Chain Crisis
When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...
RHEL 9 : osbuild-composer (RHSA-2026:56959)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56959 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...
RHEL 8 : php:8.2 (RHSA-2026:47749)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47749 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...
AlmaLinux 8 : php:8.2 (ALSA-2026:47749)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47749 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...
AlmaLinux 9 : php:8.3 (ALSA-2026:48197)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...
PT-2026-78371
Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...
CVE-2026-51367
Bottinelli Informatica Vedo Suite v.1.2.5 contains an Insecure Direct Object Reference (IDOR) vulnerability in the api_vedo/chat endpoint via the utente_chat parameter. A remote, unauthenticated attacker can manipulate this parameter to access sensitive information belonging to other users, resul...
PT-2026-78555
Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a query parameter default is emitted into...
EUVD-2026-62481
SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter...
PT-2026-78455
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values for example limitstart could trigger PHP type errors in arithmetic, and limit was not validated before use in list...
PT-2026-78314
Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature method parameter of the incoming message. signature method is required on every request, so the algorithm used to check a signature ...
PT-2026-78809
In versions below 3.8.5 of the Phantom app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking the deflate item action, because the action's password parameter is not masked and is shown in cleartext in the user interface...
PT-2026-78838
Name of the Vulnerable Software and Affected Versions OpenStack Aodh versions prior to 22.0.1 OpenStack Watcher versions 4.0.0 and later Description In OpenStack Aodh, the alarm list API fails to properly enforce project scoping when the all projects query parameter is set to false. The system...
