Linux Distros Unpatched Vulnerability : CVE-2026-101637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 9.7.0-9.7.3,...

Linux Distros Unpatched Vulnerability : CVE-2026-116540

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssltlsextticketkeycb during session ticket...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure vulnerability

Missing Authorization to Unauthenticated Data Exposure vulnerability discovered by Jay in WordPress Plugin ACF Extended versions = 0.9.2.7...

PT-2026-126403

NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure...

Grafana proxy server Data Read Modify Delete

The proxy server vulnerability in the Grafana monitoring and observability platform is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to gain read, modify, or delete data...

PT-2026-126402

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

PT-2026-126393

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high...

PT-2026-127190

Summary An unauthenticated remote attacker can crash a running MONAILabel server or silently corrupt its medical AI inference results by uploading a single crafted DICOM file 132 KB via the REST API. The vulnerability stems from pydicom's lack of validation for Decimal String DS and Integer Strin...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

Mozilla Thunderbird < 159.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 159.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-121 advisory. - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146323)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146323 advisory. In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses ...

ROS-20261027-73-0052

The vulnerability in Tomcat 10 is related to errors in handling length parameters of input data. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

ROS-20261027-73-0053

The vulnerability in Tomcat 11 is related to errors in handling length parameters of input data. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

PT-2026-127187

Summary A SQL Injection vulnerability exists in the Third Party Company update functionality of Dolibarr ERP/CRM. The localtax1 value parameter lt1 is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without any escaping, type casting, or...

ROS-20261027-73-0090

The vulnerability in the OpenSSH cryptographic protection tool is related to insecure privilege management. Exploitation of this vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial of service...

NVIDIA TensorRT-LLM server request forgery vulnerability

NVIDIA TensorRT-LLM version 1.3.0rc24 contains a server-side request forgery vulnerability. This vulnerability arises from susceptibility to server-side request forgery attacks, potentially leading to information disclosure and data tampering...

WatchGuard Fireware OS path traversal vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions from 12.0 up to and including 12.12.4 and from 12.0 up to and including 12.5.22. These vulnerabilities stem from a link-following issue in the firewall daemon. Local...

This Week in Spring - October 27th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring , which I write from the paradise-like environs Barcelona, Spain, where I was lucky enough to be a part of the amazing Vaadin Create event today and tomorrow. It's been an amazing few days, but those few days are just a small...

PT-2026-126686

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

Lobster_pro 4.12.12-LTS Token Replay / Privilege Escalation

Lobsterpro version 4.12.12-LTS and potentially other versions prior to 25.1.3 suffer from a privilege escalation vulnerability due to allowing use of non-privileged access to achieve administrative access. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Privilege escalation via request replaying ...