PT-2026-107334

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper access control in the vertex result caching subsystem allows a remote authenticated attacker to obtain sensitive information or inject malicious data. Recommendations Update I...

CVE-2026-42413: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate = 1.3.2 versions...

CVE-2026-105861: Exposure of Sensitive Information to an Unauthorized Actor

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destination that was not verified as trusted, potentially exposing a valid session to ...

CVE-2026-106339: Operation on a Resource after Expiration or Release

Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. Chromium security severity: Low...

PT-2026-107008

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An observable discrepancy in the Paint process allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using a...

ROS-20261006-73-0208

The vulnerability of the mmppdmaresidue function in the drivers/dma/mmppdma.c file of the Linux kernel’s DMA driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

PT-2026-106416

Name of the Vulnerable Software and Affected Versions Edwiser Bridge versions prior to 4.3.5 Description An issue exists that allows unauthenticated users to access sensitive data. Recommendations Update to a version newer than 4.3.4...

CVE-2026-39729: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Edwiser Bridge = 4.3.4 versions...

PT-2026-107143

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-106585: Improper Handling of Highly Compressed Data (Data Amplification)

In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length is exceeded during decompression of highly compressed data...

Linux Distros Unpatched Vulnerability : CVE-2026-98189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status regist...

RHEL 10 : openssh (RHSA-2026:76748)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76748 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

PT-2026-106468

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

PT-2026-106388

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...

PT-2026-106471

Unauthenticated Sensitive Data Exposure in Norvis Backup = 1.1.0 versions...

PT-2026-106361

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

PT-2026-107139

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A stored cross-site scripting XSS issue allows an unauthenticated attacker with adjacent-network access to inject malicious content. This content executes when ...

PT-2026-106337

Name of the Vulnerable Software and Affected Versions Fast Courier versions prior to 5.2.4 Description The Fast Courier WordPress plugin fails to restrict an unauthenticated REST route used for writing order fulfillment data. This allows unauthenticated attackers to overwrite the courier status a...

PT-2026-107298

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 3.3.1 Backstage versions prior to 3.4.1 Backstage versions prior to 4.0.3 Backstage versions prior to 4.1.0 Description The @backstage/plugin-scaffolder-backend package contains a sensitive information exposure issu...

PT-2026-106555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the memory management swap subsystem where the SWAP USAGE OFFLIST BIT flag collides with the actual usage count in the si-inuse pages counter. Because the flag is...