PT-2026-121519

The MongoDB C Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these positions can redirect a query or...

PT-2026-121389

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

PT-2026-121525

A numeric-type conversion flaw in the BSON handling library of the MongoDB C Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encoded, it is narrowed to a smaller wire...

Linux Kernel Net I/O Data Compromise

The vulnerability in the net/ipv6/mcast.c and include/net/addrconf.h components of the Linux kernel is related to the implementation of an incorrect control flow. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

Microsoft Visual Studio Code Editor Code Execution

The vulnerability of Microsoft Visual Studio Code’s editor is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-121523

A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence the content of values that the...

InterSystems IRIS for Health encryption issue vulnerability

Versions 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226 of InterSystems IRIS for Health contain an encryption vulnerability stemming from the default disabling of TLS/SSL encryption. This flaw may allow attackers to view transmitted data and use it to log into devices...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 contains an SQL injection vulnerability stemming from unauthenticated SQL injection attempts in the PAPI protocol. This vulnerability may allow unauthenticated remote attackers to obtain and modify sensitive information stored in the underlying database, thereby disrupting the norma...

PT-2026-134864

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 2.5.12-tuxcare.2...

SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:4753-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4753-1 advisory. - CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash bsc1281912. - CVE-2026-106565: a missing...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1792580871)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792580871 advisory. - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite an...

openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory. Changes in grafana: Update to version 12.4.10: Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource...

Oracle MySQL Connectors Python (October 2026 CPU)

The versions of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily...

Linux Distros Unpatched Vulnerability : CVE-2026-111810

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many suc...

Oracle MySQL Connectors ODBC (October 2026 CPU)

The versions of MySQL Connectors installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/ODBC. The supported version that is affected is 26.7.1...

Linux Distros Unpatched Vulnerability : CVE-2026-91382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that...

Linux Distros Unpatched Vulnerability : CVE-2026-101774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Serve...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142483)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142483 advisory. In the Linux kernel, the following vulnerability has been resolved: netlink: annotate lockless accesses to nlk-maxrecvmsglen syzbot reported a data-race in data-race...

PT-2026-121404

Name of the Vulnerable Software and Affected Versions Flexible GraphRAG versions 0.6.0 through 0.8.1 Description The escape helper in flexible-graphrag/langchain/graph/pg store adapters/falkordb adapter.py incorrectly escapes quotes before backslashes. This allows an inserted escape to be doubled...

openSUSE 16 Security Update : coredns (openSUSE-SU-2026:22135-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22135-1 advisory. Changes in coredns: - Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame...