PT-2026-104655

Name of the Vulnerable Software and Affected Versions gist RubyGem versions prior to 6.1.0 Description Improper certificate validation occurs because the http connection function in lib/gist.rb sets VERIFY NONE, which disables TLS certificate verification. This allows on-path attackers to interce...

EUVD-2026-91837

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu versions prior to 3.0.0 are vulnerable to a missing authentication flaw in the Playground feature. This vulnerability allows unauthenticated attackers to proxy arbitrary HTTP and HTTPS requests to URLs on the public internet. No specific exploit details or remediation steps are provid...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-105049

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-104459

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actorhandle with a numeric host and port to the abonnements view to probe internal HTTPS...

Lack of vulnerability protection in Fortinet FortiMail

Fortinet has identified a vulnerability in FortiMail. FortiMail contains a critical vulnerability CVE-2026-104286 in the processing of file paths, caused by a combination of Path Traversal CWE-22 and insufficient neutralization of NULL bytes CWE-158. An unauthorized attacker can use specially...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

CLEANSTART-2026-SE64937 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

CVE-2026-46600 affects multiple packages. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

PT-2026-104452

Name of the Vulnerable Software and Affected Versions Zilliz Attu versions prior to 3.0.0 Description The Playground feature allows the proxying of arbitrary HTTP and HTTPS requests to URLs on the public internet without requiring authentication. This leads to a Server-Side Request Forgery SSRF, ...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790962865)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790962865 advisory. - In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and...

CVE-2026-105049: Missing Authentication for Critical Function

Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URLs on the public internet...

CVE-2026-61813

GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS...

UBUNTU-CVE-2026-61813

GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS...

Missing Authentication in Brocade ASCGStreaming Service (CVE-2026-85421)

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

PT-2026-104269

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor handle with a numeric host and port to the abonnements view to probe internal HTTPS...

Exploit for CVE-2026-104286

FortiMail CVE-2026-104286 Path Traversal Exploit Overview...

CVE-2026-104286

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions may allow an unauthenticated attacker to...