PT-2026-85264

There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all...

PT-2026-85205

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoi...

PT-2026-85225

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling...

libcurl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of libcurl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request i...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

PT-2026-84930

In the Linux kernel, the following vulnerability has been resolved: ata: pata sl82c105: fix bridge revision use-after-free pci get slot returns a referenced PCI device. Commit 44c10138fd4b "PCI: Change all drivers to use pci device-revision" replaced a configuration-space read with direct access ...

PT-2026-84953

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count perm read bounds a permission value by SEL VEC MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...

PT-2026-84907

Cheshire Cat AI's GET /memory/collections/collection id/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the...

PT-2026-84932

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes BUG When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERTs related to folio size: 795 241074: drop caches: 3 assertion...

PT-2026-85269

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue...

PT-2026-85263

There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions...

RockyLinux 10 : kernel (RLSA-2026:61887)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61887 advisory. kernel: seccomp: passthrough uretprobe systemcall without filtering CVE-2025-21834 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv CVE-2026-2300...

PT-2026-84955

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a class permission count below its inherited common security get permissions maps an inherited common's permissions into an array sized by the class's own permissions.nprim, but class read takes that nprim verbati...

Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution Date: 2026-08-12 Exploit Author: Gutierre0x80 Vendor Homepage: https://www.metabase.com/ Software Link: https://github.com/metabase/metabase Version: = 0.58.0 = 0.59.0 = 0.60.0 = 0.61.0 Example: python3 exploit.py...

Curl 7.64.1 < 8.22.0 Negotiate Ambient User Connection Reuse

The version of curl installed on the remote host is 7.64.1 prior to 8.22.0. It is, therefore, affected by an information disclosure vulnerability: - A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is...

openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21713-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21713-1 advisory. Changes in MozillaFirefox: Firefox Extended Support Release 153.1.0 ESR. Fixed: Various security fixes. MFSA 2026-77 bsc1274867: CVE-2026-74934...

Fullhan FH8626V100 Command Injection / Secret Disclosure

Fullhan FH8626V100 suffers from command injection, secret disclosure, and multiple other vulnerabilities. Exploit Title: Fullhan FH8626V100 - Multiple Vulnerabilities Date: 31-03-2026 Exploit Author: Amir Aliu Vendor Homepage: https://www.fullhan.com/ Software Link: N/A - OEM/whitelabel IP camera...

UBUNTU-CVE-2026-59696

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose port component is a very long run of digits. uristring:getport/1 passes the port substring to binarytointeger/1 with no length bound,...

PT-2026-85268

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocated heap buffer during file handling. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB...

PT-2026-84948

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of node put scpsys get bus protection legacy looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regm...