SUSE-SU-2026:1314-1 Security update for ignition

This update for ignition fixes the following issue: - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-header bsc1260251...

Log Injection

Apache Log4j Core is vulnerable to Log Injection. The vulnerability is due to improper handling of newline escaping caused by renamed configuration attributes in Rfc5424Layout, which allows an attacker to inject CRLF sequences into logs and manipulate log entries...

SUSE-SU-2026:21115-1 Security update for ignition

This update for ignition fixes the following issue: - CVE-2026-33186: Fixed an authorization bypass due to improper validation of the HTTP/2: path pseudo-header bsc1260251...

CVE-2026-39677

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CreativesPlanet Emphires emphires allows PHP Local File Inclusion.This issue affects Emphires: from n/a through = 3.9...

EUVD-2026-22095

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials. Affected Products: UniFi Play PowerAmp Version 1.0.35 and earlier UniFi Play Audio Port Version 1.0.24 and earlier Mitigation: Update UniFi Play...

EUVD-2026-22093

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system. Affected Products: UniFi Play PowerAmp Version 1.0.35 and earlier UniFi Play Audio Port Version 1.0.24 and earlier Mitigation:...

EUVD-2026-22094

An Improper Input Validation vulnerability could allow a malicious actor with access to the UniFi Play network to cause the device to stop responding. Affected Products: UniFi Play PowerAmp Version 1.0.35 and earlier UniFi Play Audio Port Version 1.0.24 and earlier Mitigation: Update UniFi Play...

PT-2026-32848

Name of the Vulnerable Software and Affected Versions Windows Admin Center affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, which is a flaw where malicious scripts are injected into trusted websites. An...

PT-2026-32776

Name of the Vulnerable Software and Affected Versions Microsoft Management Console affected versions not specified Description Improper access control in the Microsoft Management Console allows an authorized attacker to elevate privileges locally, enabling them to affect the system. Recommendatio...

PT-2026-32836

Name of the Vulnerable Software and Affected Versions Azure Monitor Agent affected versions not specified Description Improper input validation allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2026-32788

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description A race condition occurs due to concurrent execution using a shared resource with improper synchronization. This allows an authorized attacker to elevate...

Fortinet FortiSOAR PaaS和Fortinet FortiSOAR on-premise 跨站脚本漏洞

Fortinet FortiSOAR PaaS and Fortinet FortiSOAR on-premise are security orchestration, automation, and response software developed by Fortinet, a US-based company. Both versions have cross-site scripting vulnerabilities, which stem from improper input during web page generation. These...

PT-2026-32798

CVE-2026-32072 Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. https://t.co/LqmmLGYoRL...

PT-2026-32676

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Improper encoding or escaping of output allows an attacker to perform log injection and forge logs by altering the payload of the 'POST /j security check' reques...

PT-2026-32687

Name of the Vulnerable Software and Affected Versions FortiSandbox versions 4.4.0 through 4.4.8 Description An OS command injection flaw exists in the JRPC API of FortiSandbox due to improper neutralization of the pipe symbol | when processing the jid parameter. This allows an unauthenticated...

PT-2026-32973

Name of the Vulnerable Software and Affected Versions free5GC versions 1.4.2 and earlier Description An improper path validation issue exists in the UDR service. An unauthenticated attacker with access to the 5G Service Based Interface can delete arbitrary Traffic Influence Subscriptions by...

Progress OpenEdge 安全漏洞

Progress OpenEdge is an enterprise-level application development and database management platform provided by the American company Progress. There is a security vulnerability in Progress OpenEdge, which stems from improper authorization in the AdminServer component. This vulnerability could allow...

Siemens SINEC NMS 安全漏洞

Siemens SINEC NMS is a network management system developed by Siemens in Germany. This system can be used for round-the-clock centralized monitoring, management, and configuration of industrial networks containing tens of thousands of devices, including those related to security applications...

CVE-2025-63939

Improper input handling in /Grocery/searchproductsitname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitemname POST parameter...

PT-2026-32869

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description Concurrent execution using a shared resource with improper synchronization, known as a race condition, allows an unauthorized attacker to cause a denial of service over a network...