PT-2026-95596

Name of the Vulnerable Software and Affected Versions Saleor versions prior to 3.20.119 Saleor versions prior to 3.21.55 Saleor versions prior to 3.22.48 Saleor versions prior to 3.23.15 Description An issue exists in the get client ip function within the saleor/account/throttling.py file. A remo...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109802)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109802 advisory. FreeRDP before 3.29.0 contains a null pointer dereference vulnerability in smartcard cache request decoders that accept NULL NDR pointers for LookupName in...

EulerOS Virtualization 2.11.1 : python-ldap (EulerOS-SA-2026-3461)

According to the versions of the python-ldap packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : python-ldap is a lightweight directory access protocol LDAP client API for Python. In versions prior to 3.4.5,...

EulerOS Virtualization 2.12.0 : nghttp2 (EulerOS-SA-2026-3655)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body ont...

Linux Distros Unpatched Vulnerability : CVE-2026-90220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.p...

level-json (>=0.0.4, <=1.0.0), scrape-eksi (>=0.0.0, <=0.0.1) +2 more potentially affected by unknown CVE via level-client (>=0.0.1, <=1.0.0)

level-client NPM version =0.0.1, =0.0.4, =0.0.0, =0.2.0, =0.2.6 Source cves: unknown CVE Source advisory: GHSA-WHVP-664W-MW2G...

Improper Encoding or Escaping of Output

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper handling of...

CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

CVE-2026-93394 libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

libmongoc SCRAM client nonce-validation bypass

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by...

Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through the UseCertificateAuthorization flow in Authorization.Certificate, specifically the AddOrgAndSpacePolicies authorization path that trusts the X-Client-Cert header. An attacker can bypass SameOrg a...

GHSA-5MQ7-RWHJ-4FH9 Steeltoe: Header-forwarded client cert lacks proof of private-key possession

Summary When Steeltoe's certificate-based authorization UseCertificateAuthorization is configured, the default configuration of the middleware relies on the X-Client-Cert HTTP header to identify the client certificate, without verifying private-key possession. This header is not stripped by commo...

CVE-2026-92943

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

EUVD-2026-82378

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

CVE-2026-92943 Improper validation of certificate with host mismatch in AWS IoT Device SDK for Python

Improper validation of certificate with host mismatch in the MQTT client TLS connection layer in AWS IoT Device SDK for Python 1.5.3 through 1.6.0 on Python 3.7 and later might allow an adversary-in-the-middle actor to impersonate the AWS IoT Core endpoint, read device telemetry, and inject...

ai.evolv:ascend-sdk (0.5.0), ai.taskmonk:taskmonk-sdk (>=1.7, <=1.16.6) +2878 more potentially affected by CVE-2026-85719 via org.asynchttpclient:async-http-client (>=2.0.0-alpha13, <=2.16.0)

org.asynchttpclient:async-http-client MAVEN version =2.0.0-alpha13, =1.7, =4.1.0, =4.2.14, =4.1.0, =4.1.0, =4.1.0, =4.2.14, =3.5.5, =3.5.5, =3.5.5, =3.5.7-jre7.0 and more Source cves: CVE-2026-85719 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963949...

com.akamai.edgegrid:edgegrid-signer-async-http-client (>=6.0.1-rc.1, <=6.0.5), com.arpnetworking.metrics:mad-experimental (>=1.2.3, <=1.2.11) +101 more potentially affected by CVE-2026-85719 via org.asynchttpclient:async-http-client (>=3.0.0.beta1, <=3.0.11)

org.asynchttpclient:async-http-client MAVEN version =3.0.0.beta1, =6.0.1-rc.1, =1.2.3, =1.22.2, =1.13.6, =1.1.0, =0.4.7, =0.4.7, =0.4.7, =1.17.0, =1.17.0, =1.17.0, =0.5.0, =0.0.9, =0.0.11 and more Source cves: CVE-2026-85719 Source advisory: SNYK:JAVA-ORGASYNCHTTPCLIENT-19963949...