PT-2026-113989

Name of the Vulnerable Software and Affected Versions PgBouncer versions 1.17.0 through 1.26.0 Description Improper authentication occurs during the SCRAM authentication process. A remote attacker who possesses the password of a user listed in the auth file can authenticate as any other user that...

PT-2026-114174

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

PT-2026-114124

Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimized translation.cpp, OptimizedTranslation::get message. Offsets read from the hash table of a crafted .translation resource are used as indices into the bucket table without bounds validatio...

PT-2026-114145

FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive process irp create, which registers an opened local file in the drive dictionary before applying the allocation size and does not remove it when that operation fails. A malicious RDP server connected to a client with...

MiracleLinux 9 : gd-2.3.2-3.el9_8.1 (AXSA:2026-2043:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2043:02 advisory. libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Tenable has extracted the preceding description block directly from the...

PT-2026-114118

unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield get file table that allows attackers to read past heap allocations via unchecked cabinet header offsets. Attackers can supply a crafted InstallShield cabinet with out-of-range file table offset or large file count...

PT-2026-113620

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage function. This is due to the startSession function accepting an empty jtlauth parameter as a valid credential, combined with insufficient fil...

PT-2026-113707

The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing address.first name' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .ph...

PT-2026-113721

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlms checkout shortcode. This is due to the llms get template helper performing extrac...

PT-2026-113646

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device...

PT-2026-113963

Name of the Vulnerable Software and Affected Versions Appium versions prior to 7.2.6 Description ZIP extraction in @appium/support allows an archive entry to create a symbolic link to a location outside the extraction directory. A subsequent regular-file entry can then resolve through this link...

PT-2026-113594

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary non-form-tag submission fields in its db7 forms row and the process bulk action delete handler then...

PT-2026-113713

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the ' type e.g. foo type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: dovecot (UTSA-2026-130077)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130077 advisory. When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130072)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130072 advisory. rsync before 3.5.0contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130076 advisory. rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink...

RockyLinux 9 : gd (RLSA-2026:81517)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:81517 advisory. libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Tenable has extracted the preceding description block directly from the RockyLinu...

Linux Distros Unpatched Vulnerability : CVE-2026-107377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130131)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130131 advisory. rsyncbefore 3.5.0contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting...

PT-2026-114237

Name of the Vulnerable Software and Affected Versions YOURLS versions prior to 1.10.5 Description An unauthenticated remote attacker can perform a directory traversal attack to include and execute local PHP files already present on the server. This occurs because the yourls get request function...