PT-2026-79070

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over...

PT-2026-79037

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. T...

PT-2026-78876

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to...

PT-2026-79038

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released...

PT-2026-78914

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer...

PT-2026-79080

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http cb function in src/http.c tests hm.proto.len with an...

Dell Wyse Management Suite < 2605.0.2 Multiple Vulnerabilities (DSA-2026-329)

The version of Dell Wyse Management Suite installed on the remote host is prior to 2605.0.2. It is, therefore, affected by multiple vulnerabilities, including: - Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A...

Oracle Java SE Multiple Vulnerabilities (August 2026 CSPU)

The 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of...

PT-2026-78917

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

PT-2026-79085

A vulnerability has been found in Tenda CH22 1.0.0.1. The affected element is the function formcreateFileName of the file /goform/formcreateFileName. The manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to th...

PT-2026-78873

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

Linux Distros Unpatched Vulnerability : CVE-2026-71126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

Linux Distros Unpatched Vulnerability : CVE-2026-71132

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Difficult to explo...

ipTIME A3004T Remote Code Execution

The EAD Service in ipTIME A3004T firmware 14.19.0 binds to UDP port 56026 and does not filter source IP addresses. A remote attacker can send a crafted EADTYPESENDCMD packet to execute arbitrary commands on the device with root privileges. Exploit Title: ipTIME A3004T - Remote Code Execution Date...

Probo 0.222.2 Insecure Direct Object Reference

Probo versions 0.222.2 and below suffer from an insecure direct object reference vulnerability. Exploit Title: Probo 0.222.2 - IDOR Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/getprobo/probo Software Link: https://github.com/getprobo/probo...

Nmap 7.9.9 Extension Header Integer Underflow

Proof of concept for the IPv6 extension header integer underflow discovered in Nmap version 7.9.9. Exploit Title: Nmap 7.99 - Extension Header Integer Underflow CVE: CVE-2026-58058 Date: 2026-06-29 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity Author...

Linuxfabrik monitoring-plugins 6.0.0 Server-Side Request Forgery

Linuxfabrik monitoring-plugins versions 6.0.0 and below suffer from a server-side request forgery vulnerability. Exploit Title: Linuxfabrik monitoringplugins6.0.0 - SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/Linuxfabrik/monitoring-plugi...

flyto_core 2.26.7 Server-Side Request Forgery

flytocore versions 2.26.7 and below suffer from a server-side request forgery vulnerability. Exploit Title: flytocore 2.26.7- Server-Side Request Forgery Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/flytohub/flyto-core Software Link:...

PT-2026-79024

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation of the argument delid results in sql injection. Remote exploitation of the attack is possible. The exploit has been made publi...

PT-2026-79124

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...