PT-2026-103831

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.17.0 through 3.18.0 Description An improper verification of cryptographic signatures occurs within the saml-auth plugin under default configuration. This allows an unauthenticated attacker to impersonate any user on...

CVE-2026-103921: Improper Certificate Validation

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loade...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783356847)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783356847 advisory. - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any...

PT-2026-103656

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the file server/src/utils/access.ts of the component Shared Link Preview Handler. The manipulation of the argument Password leads to improper authorization. The attack may be...

PT-2026-103675

A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateClientSettingsTab of the file global/code/Clients.class.php of the component Client Settings. The manipulation of the argument page titles leads to improper...

PT-2026-104050

Name of the Vulnerable Software and Affected Versions RAGFlow version 0.24.0 Description Improper access control exists in the get dataset function within the 'api/apps/evaluation app' endpoint. This flaw allows an attacker to trigger the execution of arbitrary code or commands controlled by the...

CVE-2026-102671: Improper Certificate Validation

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default...

PT-2026-105205

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

CVE-2026-51895

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-90972: Improper Access Control

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync...

CVE-2026-76142: Improper Access Control

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions...

PT-2026-104048

Name of the Vulnerable Software and Affected Versions Ragflow versions prior to 0.24.1 Description Improper access control exists in the update metadata setting function located in the api/apps/kb app.py file. This flaw allows an attacker to perform unauthorized cross-session or privilege-crossin...

Rocky Linux 8 [CIQ] Security Update: wget / wget-debuginfo / wget-debugsource (crlsa-2024_5299)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20245299 advisory. wget: Misinterpretation of input may lead to improper behavior CVE-2024-38428 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 7 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1779366607)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1779366607 advisory. - DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: fr...

Rocky Linux 8 [CIQ] Security Update: python3-lxml / python3-lxml-debuginfo (crlsa-2021_1898)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211898 advisory. python-lxml: mXSS due to the use of improper parser CVE-2020-27783 Tenable has extracted the preceding description block directly from the CIQ security advisory. No...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68660)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668660 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's FF...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68651)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668651 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...