PT-2026-107676

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...

PT-2026-107516

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot entry ID in a POST /api/v2/workoutlog/ request. The slot entry foreign key is not includ...

PT-2026-107627

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Object Injection. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 2.0.19...

PT-2026-107629

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

Cisco NX-OS Software Control Plane DoS (cisco-sa-nxos-nscpdos-SnderkC7)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. - A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service DoS condition. This vulnerability exists because rate...

Linux Distros Unpatched Vulnerability : CVE-2026-106253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome...

Linux Distros Unpatched Vulnerability : CVE-2026-106180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-106245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-106066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow was found in GIMP's raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height...

PT-2026-107545

Name of the Vulnerable Software and Affected Versions @backstage/plugin-kubernetes-backend versions prior to 0.21.8 Description Improper entity validation in a deprecated Kubernetes services endpoint allows an authenticated user with Kubernetes read permissions to access workload data beyond thei...

CVE-2026-97680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a vulnerability (CVE-2026-97680 ) caused by improper access control in the vertex result caching subsystem . This flaw could allow a remote authenticated attacker to obtain sensitive information or inject malicious data . To remediate...

CVE-2026-97680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-106392

An information leak flaw was found in the WebAudio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514426571...

CVE-2026-102407

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...

CVE-2026-106354

An improper resource exposure flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511796554...

CVE-2026-65142

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-106498

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity...

CVE-2026-53939

A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...