PT-2026-128246

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on GET /dataset/export/csv/id allow an authenticated user to export data from any dataset, including datasets created by...

PT-2026-128049

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A high privileg...

PT-2026-129145

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the...

PT-2026-128331

Ultralytics load dataset cache file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target...

PT-2026-127902

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted...

UBUNTU-CVE-2026-99134

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assocdev local-assocdev is shared between the association path and the association-response worker without common synchronization. mac802154performassociation stores the coordinato...

Linux Distros Unpatched Vulnerability : CVE-2026-116729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvdeencryptedmetadatareadtype0x001a caused by an unbounded strlen on embedded XM...

Linux Distros Unpatched Vulnerability : CVE-2026-116748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc- server.cc that exposes the X-Transmission-Session-Id anti-CSRF...

PT-2026-129066

PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions...

CVE-2026-118029: aws aws-sdk-pandas: Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler)…

Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas awswrangler before 3.16.1 might allow remote actors to read Athena query results and tamper with result sets returned to the caller via a pre-created S3 bucket. To remediate this issue, users...

PT-2026-128104

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix data corruption with concurrent writes and O TRUNC cifs do truncate flushes dirty pages with filemap write and wait and truncates the file on the server, but in the old code both operations ran without holding i...

PT-2026-127904

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 Dell PowerProtect Data Domain versions 7.13.1.0 through 7.13.1.80 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.40 Dell PowerProtect Data Domain versions 8.6.1.0 through...

PT-2026-128052

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

PT-2026-127909

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacke...

PT-2026-128127

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local-assoc dev local-assoc dev is shared between the association path and the association-response worker without common synchronization. mac802154 perform association stores the...

PT-2026-128251

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do read data/5 in lib/bandit/http2/stream.ex keeps every DA...

PT-2026-128071

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high...

PT-2026-128315

A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw document's self-declared length agrees with the extent of the byte range it is given before that range is copied into an outgoing database command. An application that wraps untrusted raw bytes in...

Linux Distros Unpatched Vulnerability : CVE-2026-99134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mac802154: fix data race and NULL deref on local-assocdev local-assocdev is shared between the association path and the association-response worker without comm...

CVE-2026-116794: Eugeny russh: russh is a Rust SSH client and server library that includes an SSH agent protocol implementation

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agent server's Connection::trysign path in russh/src/keys/agent/server.rs recognizes SSHAGENTCONSTRAINCONFIRM but returns a hard-coded successful result instead ...