PT-2026-89045

News: Schneider Electric, Siemens, and Aveva ship ICS Patch Tuesday. Worst new hit: Modicon M580 auth CVE-2026-3869 CVSS 9.2. Siemens flags critical Reyrolle 7SR5, OIS, Industrial Edge bugs. OT owners: patch controllers now. https://t.co/TT7I5NW8Ee...

Linux Distros Unpatched Vulnerability : CVE-2026-87431

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Chrome...

Exploit for CVE-2026-8732

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation E...

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software...

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022322)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022322 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022285)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022285 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Information Schema. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 a...

Jenkins - Remote Command Injection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...

Exploit for Server-Side Request Forgery in Sonicwall Sma8200V

SonicWall SMA 1000 — CVE-2026-83548 / CVE-2026-83549 Exposure...

Exploit for Deserialization of Untrusted Data in Jetbrains Teamcity

CVE-2026-63077 — JetBrains TeamCity Unauthenticated RCE !Py...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106208)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106208 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL...

CVE-2025-55182-Advanced-React-Server-Components-RCE-Exploit — Updated!

🔐 ReactRCE-Scanner CVE-2025-55182 — Advanced React Server Components RCE Exploit & Assessment Framework 📑 Table of Contents Legal Disclaimer & Ethical Notice Overview Key Capabilities Quick Start Guide Architecture & Feature Deep Dive Configuration Reference Automated Test Suite Remediation &...

VMware Workstation 25H2, 26H1.x < 26H1u1 Multiple Vulnerabilities (VMSA-2026-0007)

The version of VMware Workstation installed on the remote host is 25H2, 26H1.x prior to 26H1u1. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 809...

Injection Bouncy Castle Dependency in Confluence Data Center

This is a vulnerability in a non-Atlassian Confluence dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Injection vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and...

Linux Distros Unpatched Vulnerability : CVE-2026-80255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cook...

CVE-2026-81846

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N 3.5 Low...

Kibana 9.4.6 Security Update (ESA-2026-84)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only low, read-level Agent Builder...

Exploit for OS Command Injection in Axis Axis_Os

CVE-2025-11142 — AXIS mediaclip.cgi OS Command Injection...

Security update for postgresql17 (important)

openSUSE security update: security update for postgresql17 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21702-1 Rating: important References: bsc1275001 bsc1275002 bsc1275042 bsc1275043 bsc1275044 bsc1275046 bsc1275047 bsc1275048 bsc1275049...

CVE-2026-40204

Technical details for CVE-2026-40204 are not yet publicly available in the provided documents. The entry appears to be reserved with a placeholder description. Monitor for updates from the Open-Xchange advisory.