CVE-2026-15076

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

GHSA-8M85-WQG7-C529 SAP Approuter Vulnerable to HTTP Request Smuggling

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to ...

CVE-2026-44769

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

CVE-2026-44752 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

PT-2026-58652

Name of the Vulnerable Software and Affected Versions Windows RDP affected versions not specified Description An out-of-bounds read occurs in Windows RDP, which allows an unauthorized attacker to disclose sensitive information over a network. Recommendations At the moment, there is no information...

PT-2026-58328

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Windows Push Notifications contain a flaw that allows an authorized attacker to locally disclose sensitive information. This issue results in the exposure of push-notification data to...

PT-2026-58115

Name of the Vulnerable Software and Affected Versions Windows Audio Service affected versions not specified Description An issue in the Windows Audio Service allows an authorized attacker to locally disclose sensitive information to an unauthorized actor. Recommendations At the moment, there is n...

CVE-2026-52101

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go...

PT-2026-58199

Name of the Vulnerable Software and Affected Versions Windows Trusted Runtime Interface Driver affected versions not specified Description An authorized attacker can locally disclose sensitive information due to an exposure of sensitive data within the Windows Trusted Runtime Interface Driver...

PT-2026-58926

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.83, a LiveQuery subscriber could receive object field values they were not authorized to read when a single save changed both an object field and the subscriber's ACL rea...

PT-2026-58395

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An issue in Windows Win32K allows an authorized attacker to locally disclose sensitive information to an unauthorized actor, which can affect the system. Recommendations At the moment,...

PT-2026-58070

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description An excessive data exposure issue in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. An attacker can use these hashes to...

PT-2026-58388

Name of the Vulnerable Software and Affected Versions Windows Overlay Filter affected versions not specified Description An issue in the Windows Overlay Filter allows an authorized local attacker to disclose sensitive information. This flaw enables local users to access data that should be...

PT-2026-57935

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description An unauthenticated attacker can exploit an HTTP Request Smuggling issue by sending a specially crafted HTTP request. This leads to request-response desynchronization, a condition where...

KB5099444: Windows Server 2012 R2 Security Update (July 2026)

The remote Windows host is missing security update 5099444. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network. CVE-2026-58594 - Heap-based buffer overflow in Windows Message Queuing...

PT-2026-58044

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description The booking reschedule view at the endpoint /index.php/booking/reschedule/appointment hash handled by the Booking::index function embeds the complete customer record as inline JavaScript...

CVE-2026-58408 ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII

ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information...

Security update for curl

This update for curl fixes the following issues CVE-2026-4873: connection reuse ignores TLS requirement bsc1262631. CVE-2026-8286: wrong STARTTLS connection reuse bsc1268402. CVE-2026-8458: wrong reuse for different services bsc1268407. CVE-2026-8924: traling dot domain super cookie bsc1268409...

Decidim: JWT-backed authentication can be replayed across organizations

Description A JWT issued to an Org 1 account is accepted on the Org 2 API and can read the admin-only GraphQL participantDetails field for an Org 2 participant. The same trust-boundary problem also affects API-user authentication: an Org 1 API user can use a JWT on the Org 1 host and replay that...

PYSEC-2026-2343 Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A bug in Apache Airflow's Variable response masker caused nested-key redaction triggered by secret-suffixed key names like password, token, secret, apikey to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nest...