PT-2026-65357

Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...

PT-2026-65362

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service in gitea.dev...

PT-2026-65378

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea...

PT-2026-65356

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...

PT-2026-64979

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check dir level/2, which tracks directory depth as a running integer...

PT-2026-65374

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea...

PT-2026-64878

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An infinite loop issue exists in the Python, Go, PHP, and Java bindings of Apache Thrift. This occurs due to a loop with an unreachable exit condition within the TCompactProtocol varint...

Xalgorix Autonomous AI Pentesting Agent 4.5.87

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

Security Advisory 0144

Security Advisory 0144 PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-16812 CVSSv3.1 Base Score: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 10.0...

PT-2026-65347

Several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-int arithmetic. On 32-bit targets, the truncation paths can silently bypass byte-slice limits,...

PT-2026-64858

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT FAILED before nvmet req uninit in digest error path In nvmet tcp try recv ddgst, when a data digest mismatch is detected, nvmet req uninit is called unconditionally. However, if the command arrived via the...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2026:0264-1 Rating: important References: 1272460 Cross-References: CVE-2026-16804 CVE-2026-16805 CVE-2026-16806 CVE-2026-16807 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes four...

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator an...

ALSA-2026:46395 Important: go-fdo-server security update

This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location...

Linux Distros Unpatched Vulnerability : CVE-2026-13063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted...

MiracleLinux 9 : dracut-057-115.git20260527.el9_8 (AXSA:2026-1356:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1356:03 advisory. dracut: dracut: Root code execution via DHCP options command injection CVE-2026-6893 Tenable has extracted the preceding description block directly from the...

Xerox Printers Remote Command Execution (CVE-2021-28671)

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

Xerox Printers Clone File Command Injection (CVE-2021-28673)

Xerox Phaser 6510 before 64.61.23 and 64.59.11 Bridge, WorkCentre 6515 before 65.61.23 and 65.59.11 Bridge, VersaLink B400 before 37.61.23 and 37.59.01 Bridge, B405 before 38.61.23 and 38.59.01 Bridge, B600/B610 before 32.61.23 and 32.59.01 Bridge, B605/B615 before 33.61.23 and 33.59.01 Bridge,...

RHEL 10 : go-fdo-server (RHSA-2026:46395)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46395 advisory. This package provides a server-side implementation of the FIDO Device Onboard FDO specification, written in Go. FDO is an open standard fo...

Linux Distros Unpatched Vulnerability : CVE-2026-13073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in deni...