Linux Distros Unpatched Vulnerability : CVE-2026-47892

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request...

CVE-2026-82726: Permissive Regular Expression

Permissive Regular Expression vulnerability in ash-project ashphoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.getsubdomain/2 stripped the root domain with String.replacehost, r/.?roothost/, "". Th...

Linux Distros Unpatched Vulnerability : CVE-2026-82661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message header...

Debian dla-4762 : libarchive-dev - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4762 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4762-1 [email protected]...

PT-2026-84048

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the MediaStreamController.php file where the /media/id/download/slug endpoint and its administration variant honor the inline query parameter for...

Linux Distros Unpatched Vulnerability : CVE-2026-80599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: dat: ensure accessible ethhdr proto field When batadvgetvid accesses the proto field of the ethernet header, it is not checking if the data itself i...

PT-2026-83644

Origin Validation Error vulnerability in ash-project ash ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed origins: nil, origin...

PT-2026-83690

Permissive Regular Expression vulnerability in ash-project ash phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get subdomain/2 stripped the root domain with String.replacehost, r/.?root host/, ""...

Linux Distros Unpatched Vulnerability : CVE-2026-59314

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-82644 WWBN AVideo Brute-force Rate Limiting Bypass via Missing User-Agent

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

OESA-2026-3517 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing...

OESA-2026-3516 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing...

PT-2026-83570

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

openSUSE 16 Security Update : coredns (openSUSE-SU-2026:21674-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21674-1 advisory. Changes in coredns: - Update to version 1.14.7: plugin/acl, plugin/cache, plugin/file, plugin/forward, plugin/kubernetes: assorted correctness fixes...

CVE-2026-82639: Improper Input Validation

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...

CVE-2026-14835: Improper Neutralization of Input During Web Page Generation

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...