PT-2026-120160

Vyper before 0.2.9 deploys forwarder proxies through the built-in create forwarder to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return dat...

EasySoft ZenTao PMS authorization issue vulnerability

EasySoft ZenTao PMS versions prior to 22.3 contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in commonModel::isOpenMethod, allowing logged-in users to bypass group-based ACL checks on any method containing ‘ajax’. As a result, low-privilege users...

CVE-2026-91403: Java CPU October 2026 Oracle Java SE vulnerability

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and...

PT-2026-122066

Name of the Vulnerable Software and Affected Versions Save Life versions prior to 1.2.15 Description Save Life is subject to PHP Object Injection due to the deserialization of untrusted data. This allows unauthenticated attackers to inject a PHP Object. While no native POP chain a sequence of...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1792589925)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792589925 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certa...

Linux Distros Unpatched Vulnerability : CVE-2026-110036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted devic...

Linux Distros Unpatched Vulnerability : CVE-2026-91451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1,...

Linux Distros Unpatched Vulnerability : CVE-2026-91453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Lightweight HTTP Server...

GitLab 19.2 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-103515)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when an instance administrator locked a group's Duo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-gunicorn (UTSA-2026-142338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142338 advisory. Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback...

Linux Distros Unpatched Vulnerability : CVE-2026-83376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions tha...

Characterizing and Defending Utility-Hijacking in Instruction-Tuning Data Selection

Instruction-data selectors choose which instruction-following records are used for fine-tuning, improving alignment quality, raising training efficiency, and filtering out harmful records. A selector's choices thus directly affect the fine-tuned model's safety, yet despite their widespread use, t...

OpenStack Manila authorization issue vulnerability

OpenStack Manila versions prior to 1.0.0 through 20.0.3, 21.0.0 through 21.0.3, 22.0.0 through 22.0.2, and 23.0.0 through 23.0.1 contain an authorization issue vulnerability. This vulnerability arises because multiple Manila API operations grant authorization solely within the context of the...

Laravel framework code injection vulnerability

A code injection vulnerability exists in Laravel versions from 12.45.0 up to 12.68.0 and from 13.0.0 up to 13.27.0. This vulnerability stems from carefully crafted relational constructs on read-only endpoints, which may trigger destructive database operations on related tables. As a result, users...

Apache Pulsar authorization issue vulnerability

Versions of Apache Pulsar from 2.0.0-rc1-incubating up to 4.0.14 and from 4.1.0 up to 4.2.5 contain an authorization issue vulnerability. This vulnerability arises because the Functions Worker triggers function endpoints that fail to verify whether the caller has the necessary permissions to...

Apache Pulsar authorization issue vulnerability

Versions 3.0.0 through 4.0.14 and 4.1.0 through 4.2.5 of Apache Pulsar contain an authorization issue vulnerability. This vulnerability arises because authorization checks are not performed on source topics specified via the PULSAR.SHADOWSOURCE attribute when creating or updating topics. As a...

PT-2026-122071

Name of the Vulnerable Software and Affected Versions HotLock versions prior to 1.4.0 Description ThemeREX Group HotLock allows PHP Object Injection due to the deserialization of untrusted data. This issue enables unauthenticated attackers to inject a PHP Object. While no POP chain a sequence of...

PT-2026-120849

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.4 Splunk Enterprise versions prior to 10.2.8 Splunk Enterprise versions prior to 10.0.11 Splunk Enterprise versions prior to 9.4.16 Description A user with a role possessing the schedule search capabili...

Nuxt processing logic error vulnerability

A security vulnerability exists in Nuxt versions prior to 3.21.4, as well as versions 3.11.0 and later, and prior to 4.4.4, as well as version 4.0.0 and later. This vulnerability stems from improper handling of percent encoding when comparing route rule keys against the original request path. As ...

PT-2026-120755

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...