PT-2026-77179

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when t...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

PT-2026-78228

Name of the Vulnerable Software and Affected Versions Linuxfabrik Monitoring Plugins versions prior to 7.0.0 Description The check-plugins/logfile/logfile plugin accepts a free-form --filename path and opens it with root privileges when invoked via the provided nagios or icinga sudoers allowlist...

CVE-2026-52607

A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...

PT-2026-77233

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico criteria parameter in conjunction with the execute mode=CRITERIA parameter of run.php...

Linux Distros Unpatched Vulnerability : CVE-2026-72483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the...

AlmaLinux 10 : php8.4 (ALSA-2026:49914)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:49914 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.4.23 for...

Linux Distros Unpatched Vulnerability : CVE-2026-72395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 hwmon: pmbus/core Protect regulator operations with mutex introduced a...

AlmaLinux 10 : php (ALSA-2026:48170)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48170 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

EUVD-2026-61095

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

PT-2026-77161

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat smplooped in src/load pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat loops, so an index of zero reads pat loops-1, one byt...

CVE-2026-52607

reportico-web versions up to and including 8.1.0 are affected by a directory traversal vulnerability in the run.php endpoint. By supplying a crafted filename in the target_format parameter combined with execute_mode=EXECUTE, a remote unauthenticated attacker can expose or execute arbitrary PHP fi...

PT-2026-77162

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description Insufficient validation of the allow shell configuration parameter within project config files allows for arbitrary shell command execution. An attacker can achieve this by committing a malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-72083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with...

Linux Distros Unpatched Vulnerability : CVE-2026-72158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is...

Linux Distros Unpatched Vulnerability : CVE-2026-72442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to use pskbmaypull instead of skbheaderpointer to ensure the outer IPv6...

Fortinet FortiWeb Broken access control in the RADIUS type admin group (FG-IR-26-158)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-158 advisory. - An Improper Authentication vulnerability CWE-287 vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-129 (ALASKERNEL-5.10-2026-129)

The version of kernel installed on the remote host is prior to 5.10.262-262.1063. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2057)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2057 advisory. In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clear Present bit before tearing down context entry CVE-2026-45944 In the Linux kernel, the following...

PT-2026-80762

Name of the Vulnerable Software and Affected Versions LibreNMS versions 21.6.0 through 26.4.0 Description An authenticated administrator can execute arbitrary operating-system commands on the host server. The issue occurs because the deliverAlert function in LibreNMS/Alert/Transport/Signal.php...