PT-2026-71885

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized keys for the asterisk system user without reliably enforcing backup-only...

PT-2026-71486

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan file parameter, leading to Remote Code Execution. Combined with open registration no invite...

PT-2026-71708

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71676

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.20 Description An unauthenticated attacker can execute arbitrary operating system commands as the Zimbra user by sending specially crafted SMTP requests. This occurs when the optional zimbra-snmp...

PT-2026-71759

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description The native inference process used to evaluate uploaded machine learning models fails to validate that a memory address offset supplied within the model remains within the bounds of the...

PT-2026-71480

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 18.0 through 18.4 Description Type confusion in the pg restore attribute stats function allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs d...

PT-2026-71479

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description An integer wraparound in the fuzzystrmatch module allows ...

PT-2026-71469

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion in the "refint" module allows an object...

PT-2026-71484

Untrusted data inclusion in pg dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql restrict meta-command input expansion. The fix for CVE-2025-871...

PT-2026-71468

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the plperl language...

PT-2026-71464

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

PT-2026-71476

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion involving the internal data type arguments...

PT-2026-71481

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A type confusion issue exists in the portal and cursor...

ROS-20260813-73-0052

The vulnerability in uriparser is related to numerical truncation errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260813-73-0055

The vulnerability in perl-XML-Parser is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260813-73-0005

The vulnerability in Gitea is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-71743

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A buffer overflow allows a remote authenticated attacker to execute arbitrary code. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is designed to hol...

Security Updates for Microsoft Access Products C2R (August 2026)

The Microsoft Access Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally. CVE-2026-64906, CVE-2026-64908, CVE-2026-64914, CVE-2026-64920 -...

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files...