PT-2026-87193

🚨 On-prem Exchange has another “please patch immediately” moment: CVE-2026-55007 lets unauthenticated attackers execute code remotely. Double-free memory bugs: free once, panic twice. https://t.co/0McWeFeyWd MicrosoftSecurity Msrc Cve202655007 https://t.co/4SZ9ynrPay...

PT-2026-88486

Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-87179

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

EUVD-2026-72911

An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message...

CVE-2026-78834

A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page content and provide controlled imported content can trigger server-side execution by referencing crafted external or uploaded text content through the affected...

PT-2026-88489

Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-71328

Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

EUVD-2026-74262

In Halo = 2.25.4, the plugin management feature allows users to install/update malicious plugins, which could let attackers execute any command with Halo process permissions...

PT-2026-87893

Something to consider when ranking vulnerabilities CVE-2026-72982 has been public for a couple of days, so why aren’t attackers already using it to pop shells on DCs? Everyone has LLMs now, right? Finding a bug and producing a crash is not the same as building reliable RCE. https://t.co/HCBIKjO6N...

PT-2026-87086

🚨 CRITICAL — CVE-2026-12647 A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker t… CVSS 9.9 🔴 No patch yet Full analysis → https://t.co/U5cnKwTpNI Ivanti CyberSecurity InfoSec...

PT-2026-88316

The permanent fix is 26.6.5, but out-of- maintenance on-prem customers may need to renew before they can install it. Temporary mitigation is to disable TransferFiles. Fair enough for features and support. Less sure about paying for a Critical security fix in software already purchased. Curious wh...

PT-2026-88142

A new vulnerability with increased severity was disclosed for Microsoft Windows CVE-2026-83997 https://t.co/Di6uxnlzNX...

CVE-2026-78997

UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314 ) is affected by a Universal Cross-Site Scripting vulnerability. The root cause is a reflected XSS on a UC-owned domain that leverages the browser's internal JavaScript bridge to register a deferred callback. This allows an at...

Important: valkey security, bug fix, and enhancement update

Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing s...

RHEL 9 : redis (RHSA-2026:64824)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64824 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

KB5122880: Windows 11 version 23H2 Security Update (September 2026)

The remote Windows host is missing security update 5122880. It is, therefore, affected by multiple vulnerabilities - Heap-based buffer overflow in Windows USB Mass Storage Class Driver allows an unauthorized attacker to execute code over a network. CVE-2026-68839 - Integer underflow wrap or...

Linux Distros Unpatched Vulnerability : CVE-2026-76561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate...

MiracleLinux 8 : perl-DBI-1.641-2.el8_10 (AXSA:2026-1774:03)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1774:03 advisory. perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. CVE-2026-10879 DBI: DBI: Buffer...

EulerOS 2.0 SP12 : shim (EulerOS-SA-2026-3311)

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A specially crafted PKCS7 or S/MIME signed message could trigger a use-after-free during PKCS7 signature verification. Impact summary:...

RHEL 8 : expat (RHSA-2026:64809)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64809 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call...