UBUNTU-CVE-2026-17183

An authenticated user with permission to create or edit alert rules ca...

UBUNTU-CVE-2026-76222

GitPython before 3.1.58 fails to validate submodule names from .gitmod...

CVE-2026-47827 - BOSH CLI Powershell Injection | Cloud Foundry

HIGH CVSSv4: High 7.7 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSSv3: High 7.5 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH CLI tool – All versions v2.840.0 Description Command...

PT-2026-79027

Name of the Vulnerable Software and Affected Versions aiosmtplib versions prior to 5.1.2 Description The SMTPProtocol.start tls function in src/aiosmtplib/protocol.py fails to clear the SMTPProtocol. buffer after consuming the server's 220 response and initiating the TLS handshake. A network...

Important: php:8.3 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

PT-2026-79038

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released...

PT-2026-79147

Name of the Vulnerable Software and Affected Versions bandit versions 1.4.0 through 1.12.4 Description An improper neutralization of CRLF sequences allows an unauthenticated remote attacker to smuggle Carriage Return CR, Line Feed LF, or Null NUL characters into application-visible request header...

PT-2026-78968

Unauthenticated SQL Injection in TheGem Elementor = 5.12.3 versions...

PT-2026-78873

Name of the Vulnerable Software and Affected Versions code-projects Employee Management System version 1.0 Description A SQL injection flaw exists in the Admin Login Endpoint within the /process/aprocess.php file. The issue occurs when the mailuid argument is manipulated, allowing for remote...

PT-2026-79068

A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file password-recovery.php. The manipulation of the argument email leads to sql injection. Remote exploitation of the attack is possible. The...

PT-2026-79039

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

PT-2026-78926

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description A NoSQL injection issue exists in the MongoDB node's Find, Delete, and Aggregate operations. The software parses the Query parameter as JSON...

PT-2026-79139

Name of the Vulnerable Software and Affected Versions @dicebear/core versions prior to 9.4.3 @dicebear/initials versions prior to 9.4.3 Description An issue exists where certain options are interpolated into SVG attributes without XML escaping. In @dicebear/core, the addRotate function fails to...

PT-2026-78927

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 Description A PostgREST filter injection issue exists in the Supabase node during Row Get Many, Delete, and Update operations. The system constructs filte...

PT-2026-78976

Unauthenticated PHP Object Injection in Flatastic = 2.0 versions...

PT-2026-79199

Name of the Vulnerable Software and Affected Versions Azure Managed Instance for Apache Cassandra affected versions not specified Description Improper neutralization of argument delimiters in a command, known as argument injection, allows an unauthorized attacker to execute code over a network...

PT-2026-79249

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote authenticated attackers can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fai...

PT-2026-79091

Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The 'move plugin' endpoint in 'cms/admin/placeholderadmin.py' fails to validate the plugin parent value, allowing a staff user with plugin-change permissions to assign a plugin's own identifier or...

PT-2026-79082

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg http next multipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and...

RockyLinux 9 : php:8.3 (RLSA-2026:57539)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57539 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...