399033 matches found
PT-2026-126398
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module Qt Core in Qt 5 and earlier impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and ma...
PT-2026-126436
PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A...
PT-2026-126374
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url values, or image href attributes to exfiltrate page...
Amazon Corretto Java 8.x < 8.512.08.1 Multiple Vulnerabilities
The version of Amazon Corretto installed on the remote host is 8 prior to 8.512.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2026-Oct-20 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ...
PT-2026-126437
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high...
Faraday 5.25.2
Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...
PT-2026-126642
An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...
PT-2026-126373
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...
PT-2026-126645
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...
PT-2026-126441
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high...
PT-2026-126406
Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0 Description A missing authentication flaw allows an attacker to bypass security checks. This issue may lead to remote code execution, escalation of privileges, data tampering, denial of...
Semantic MediaWiki cross-site request forgery vulnerability
Versions 3.0.0 through 7.3.1 of Semantic MediaWiki contain a cross-site request forgery vulnerability. This flaw arises because Special:SMWAdmin overwrites wpEditToken with a newly generated valid token, making it susceptible to such attacks. Attackers can trick authenticated smw-admin users into...
PT-2026-126440
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high...
Linux Distros Unpatched Vulnerability : CVE-2026-65627
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Highly Compressed Data Data Amplification vulnerability in potatosalad jose erlang-jose allows a remote attacker to exhaust a node's memory...
PT-2026-126407
NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure...
WordPress Bookly 28.2 Insecure Direct Object Reference
WordPress Bookly plugin versions through 28.2 contain an unauthenticated insecure direct object reference that exposes order tokens and calendar appointment data. The included proof of concept enumerates order tokens and extracts calendar data. https://packetstorm.news/download/237870...
This Week in Spring - October 27th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring , which I write from the paradise-like environs Barcelona, Spain, where I was lucky enough to be a part of the amazing Vaadin Create event today and tomorrow. It's been an amazing few days, but those few days are just a small...
PT-2026-126686
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146323)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146323 advisory. In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses ...
