PT-2026-78719

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be...

PT-2026-78717

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

ALSA-2026:56969 Important: php8.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

UBUNTU-CVE-2026-74962

Site isolation issue in the Networking: Cookies component. This vulner...

CVE-2026-51367

Bottinelli Informatica Vedo Suite v.1.2.5 is vulnerable at the api_vedo/chat endpoint; the utente_chat parameter allows a remote attacker to obtain sensitive information, indicating an Insecure Direct Object Reference (IDOR) issue. No patch version, exploit details, or in-the-wild exploitation ar...

PT-2026-78548

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

VulnCheck KEV: CVE-2026-32475

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

PT-2026-78551

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...

ALSA-2026:57126 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: crypto/x509: golang: Go crypto/x509: Certificate...

UBUNTU-CVE-2026-74980

Clickjacking issue in the Downloads component in Firefox for Android...

UBUNTU-CVE-2026-74960

Site isolation issue in the WebExtensions component. This vulnerabilit...

ALSA-2026:57148 Important: ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

UBUNTU-CVE-2026-74975

Spoofing issue in the Downloads component in Firefox for Android. This...

Oracle Linux 8 : python3 (ELSA-2026-56219)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-56219 advisory. 3.6.8-78.0.1 - Add Oracle Linux distribution in platform.py Orabug: 20812544 3.6.8.openela.0 - Add openela to supported dists 3.6.8-78 - Security fix for...

The vulnerability of the NewKeyring() function in the Go programming language allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the NewKeyring function in the Go programming language is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

RHEL 9 : gegl04 (RHSA-2026:56982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56982 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffe...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: bind (UTSA-2026-103694)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-103694 advisory. A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able...

RHEL 8 : php:7.4 (RHSA-2026:47750)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47750 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

Mozilla Thunderbird < 154.0

The version of Thunderbird installed on the remote Windows host is prior to 154.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-78 advisory. - Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbir...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102688)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102688 advisory. libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap...