PT-2026-58844

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An integer overflow or wraparound occurs, which can be exploited by an attacker to crash the application. This leads to a denial-of-service condition and does not require user...

PT-2026-60889

Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure Cybersecurity Admin Expert affected versions not specified Description Insufficient protection of stored credentials within the application allows a local privileged attacker to bypass authentication and perform...

PT-2026-58900

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

PT-2026-58841

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation allows an attacker to crash the application, resulting in a denial-of-service condition. This issue can be exploited without any user interaction...

PT-2026-58830

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Untrusted Search Path issue exists that could allow arbitrary code execution within the context of the current user. This occurs when an application searches for a file or...

PT-2026-58832

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An issue involving insufficiently protected credentials could lead to the disclosure of sensitive information. An attacker could exploit this to gain unauthorized read access...

PT-2026-58836

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation allows an attacker to bypass security features and obtain unauthorized write access. This issue can be exploited without any user interaction...

APSB26-80 : Security update available for Content Credentials SDK

Adobe has released security updates for Content Credentials SDK. This update addresses critical and important vulnerabilities that could result in arbitrary code execution, application denial-of-service, arbitrary file system read, security feature bypass, and privilege escalation...

PT-2026-57986

Name of the Vulnerable Software and Affected Versions Eclipse Vert.x versions prior to 4.5.30 Eclipse Vert.x versions prior to 5.1.5 Description The DefaultRedirectHandler in the vertx-core module propagates all request headers during cross-origin HTTP 30x redirects without performing origin...

PT-2026-58833

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Integer Underflow Wrap or Wraparound issue exists, which occurs when an arithmetic operation results in a value smaller than the minimum representable value for the data...

PT-2026-58831

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description A Server-Side Request Forgery SSRF issue exists that could lead to arbitrary code execution within the context of the current user. This flaw allows an attacker to inject...

PT-2026-58842

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description Improper input validation allows a remote attacker to cause an application crash, resulting in a denial-of-service condition. This issue can be exploited over the network and...

PT-2026-58108

Nexus Repository 3 did not apply its existing Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. Any user with read access to a proxy repository backed by an attacker-controlled or compromised upstream server — including an anonymo...

PT-2026-58016

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 5.0.0 through 9.0.x Description A path traversal issue exists where the software fails to properly limit pathnames to a restricted directory. An attacker with moderator rights in any room can read arbitrary files...

CVE-2026-59801

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-59801

CVE-2026-59801 affects 9Router up to version 0.4.41 and is caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*. It allows unauthenticated remote interaction with provider management endpoints, enabling enumeration, creation, modification, or deletion of...

CVE-2026-59801

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...