PT-2026-114993

: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

PT-2026-114996

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics UniStream Pro/UniLogic: Unitronics UniStream Pro versions only B10 / C10 – UniLogic versions prior to 1.41.329...

RHEL 8 : mariadb-connector-c (RHSA-2026:83517)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83517 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

PT-2026-115106

Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signature Contract Add-On: from n/a through 3.2.5...

PT-2026-114998

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy html escape form data to the encoded string, and then uses base64 decode to decode the value directly into the GPS...

PT-2026-115066

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie init file in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num pages field as the loop bound for byte-swapping page sizes entries. A crafted file can make the loo...

PT-2026-114947

Name of the Vulnerable Software and Affected Versions Siemens Software Center affected versions not specified Description The application loads dynamic-link libraries DLLs from an uncontrolled search path. This allows an authenticated local attacker to place a specially crafted DLL in a directory...

PT-2026-115114

Name of the Vulnerable Software and Affected Versions HtmlUnit Neko versions prior to 5.4.0 Description HtmlUnit Neko, an adaptation of NekoHTML, contains an issue where the HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding. This occurs because both...

PT-2026-115097

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4...

Unity Linux 20.1070e Security Update: tomcat (UTSA-2026-130389)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130389 advisory. Off-by-one Error vulnerability in Apache Tomcat impacting the N flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2026-130398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130398 advisory. A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via...

Unity Linux 20.1070e Security Update: sqlite (UTSA-2026-130356)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130356 advisory. An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup...

PT-2026-115082

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...

PT-2026-115019

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow unsafe links...

PT-2026-115076

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

PT-2026-114976

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

Important: rpcbind security update

The rpcbind utility is a server that converts Remote Procedure Call RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fixes: rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows...

Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

Unbreakable Enterprise kernel security update

5.15.0-325.221.6.3 - exec: Cleanup POSIX timers right after dethread Hyunwoo Kim Orabug: 40157515 CVE-2026-98260 5.15.0-325.221.6.2 - eventpoll: fix epremove struct eventpoll / struct file UAF Christian Brauner Orabug: 39784995 CVE-2026-46242 - eventpoll: move epifget up Christian Brauner Orabug:...

Moderate: wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fixes: wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash CVE-2026-76886 wireshark: Wireshark: Denial of Service via RRC protocol...