CVE-2026-120956: MongoDB C Driver: The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query…

The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application...

MCPJam Inspector 1.4.2 Remote Code Execution

MCPJam Inspector versions 1.4.2 and earlier contain an unauthenticated remote code execution vulnerability through the API endpoint that installs MCP server configurations. The supplied proof of concept submits a crafted server configuration to execute a command...

PT-2026-136341

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-120673: MongoDB Rust Driver: A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before…

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access t...

CVE-2026-63418: monitoring-plugins: Monitoring Plugins is a suite of plugins for monitoring applications

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, checkicmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the...

EUVD-2026-116106

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint...

CVE-2026-115732: Perforce Puppet Enterprise: Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in…

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables...

This Week in Spring - November 3rd, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's Tuesday, and you know what that means? I'm thinking about production. Now, to be fair, I'm always thinking about production. But recently, I've been spending the weekend just overjoyed at how simple it was to get Cloud...

PT-2026-136744

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST METHOD. For a REQUEST METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path info from the...

PT-2026-136440

Name of the Vulnerable Software and Affected Versions Puppet Server affected versions not specified Puppet Enterprise affected versions not specified Description Incorrect authorization occurs during certificate-name matching in trapperkeeper-authorization. A client possessing a CA-signed...

Security update for cadvisor (important)

openSUSE Security Update: Security update for cadvisor Announcement ID: openSUSE-SU-2026:0365-1 Rating: important References: 1283657 Cross-References: CVE-2026-63209 CVSS scores: CVE-2026-63209 SUSE: 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE...

CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required...

CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...

UBUNTU-CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

UBUNTU-CVE-2026-119567

vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmdsdenied check in processpostlogin compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to...

UBUNTU-CVE-2026-119025

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $... subexpressions in URLs, such as OAuth authorizationendpoint values from malicious MCP servers, which...

Rocky Linux 8 [CIQ] Security Update: perl / perl-Algorithm-Diff / perl-Archive-Tar / perl-Archive-Zip / etc (crlsa-2026_85917)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685917 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-119025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows an...

AlmaLinux 8 : perl:5.32 (ALSA-2026:85917)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:85917 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...

CVE-2026-38595

A vulnerability in im3x Scriptables (v2-dev branch) allows attackers to perform arbitrary OS command injection . This occurs when a user uploads a file with a crafted filename to the /sync endpoint . The provided documents do not specify a remediation, exploit details, or specific versions for th...