PT-2026-76672

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

PT-2026-76659

Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.3.0.1 Description An OS Command Injection issue exists due to the improper neutralization of special elements used in an OS command. A low privileged attacker with local access could exploit this flaw to...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099550 advisory. Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser ...

RHEL 10 : vim (RHSA-2026:55431)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55431 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary Code Execution via crafted...

RHEL 8 : redhat-ds:11 (RHSA-2026:55532)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55532 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

RHEL 8 : kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 (RHSA-2026:55762)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55762 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

ALSA-2026:55424 Important: 389-ds-base security update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status...

Important: sg3_utils

Issue Overview: A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary propertie...

PT-2026-76657

Name of the Vulnerable Software and Affected Versions Dell ObjectScale versions prior to 4.3.0.1 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with local access could exploit this flaw to execut...

PT-2026-76606

openssl encrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr crypt cli.py, handle hsm command. The printed value can persist i...

PT-2026-76809

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

PT-2026-76701

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects...

ALSA-2026:55617 Important: pcp security update

Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: PCP: PCP...

Joomla JCE_2.9.15 - Remote Code Execution

Exploit Title: Joomla JCE2.9.15 - Remote Code Execution Date: 2026-07-10 Exploit Author: K3ysTr0K3R Jared Brits Vendor Homepage: https://www.joomla.org/ Software Link: https://extensions.joomla.org/extension/jce/ Version: JCE 1.0.0 through 2.9.99.4 fixed in 2.9.99.5 Tested on: Joomla 3.10.11 / JC...

PT-2026-76764

Name of the Vulnerable Software and Affected Versions Legora versions prior to 2026-08-14 Description A cross-site scripting issue exists where attackers can execute arbitrary JavaScript in a victim's browser. This occurs when a Mermaid block is prefixed with a gray-matter JavaScript front-matter...

PT-2026-76642

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description An issue exists where mail search and LITERAL+ byte-count desynchronization can occur. This condition allows for IMAP command injection, whi...

PT-2026-73430

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.40.0 until 1.75.0, rclone serve restic does not correctly reject URL paths beginning with ../ in cmd/serve/restic/restic.go WithRemote, which accepts a leading parent path and pass...

PT-2026-73431

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

PT-2026-73434

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

PT-2026-76714

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the action system where an administrator can configure shell commands to run when monitoring thresholds are crossed. These commands use Mustache templates that are filled with...