PT-2026-66419

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description The MQTT Service contains a Server-Side Request Forgery SSRF flaw. An unauthenticated remote attacker can send a malicious ID to the MQTT Broker, which allows the...

IBM Langflow OSS configuration error vulnerability

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications through drag-and-drop components. Additionally, it supports deep customization using Python to integrate...

The vulnerability of the smc_tcp_syn_recv_sock() function in the net/smc/af_smc.c module of the SMC protocol family implementation in Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smctcpsynrecvsock function in the net/smc/afsmc.c module of the SMC protocol family implementation in Linux’s kernel relates to the reutilization of previously freed memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrit...

The vulnerability of the automatic update mechanism for PAK ViPNet Coordinator HW 4, ViPNet Coordinator IG 4, and ViPNet xFirewall 5 lies in the excessive capabilities for decompressing updates. This allows a malicious entity with pre-compromised network management centers (NMCs) to create specially modified update packages, distribute them to managed PAKs, and thereby compromise the integrity of their operating environments.

Vulnerability of the automatic update mechanism for PAK ViPNet Coordinator HW 4, ViPNet Coordinator IG 4, and ViPNet xFirewall 5, due to excessive capabilities for decompressing updates. Exploiting this vulnerability allows a malicious actor, operating from a pre-compromised network management...

kernel security, bug fix, and enhancement update

5.14.0-687.31.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

The vulnerability of the `init_amd_zen1()` function in the `arch/x86/kernel/cpu/amd.c` module, which is part of the Linux operating system’s kernel support for x86 platforms, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the initamdzen1 function in the arch/x86/kernel/cpu/amd.c module, which is part of the Linux operating system’s kernel support for x86 platforms, is related to incorrect inter-process boundary removal of critical data. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the packet_do_bind() function in the net/packet/af_packet.c module of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the packetdobind function in the net/packet/afpacket.c module of the Linux operating system is related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

The vulnerability of the tcf_csum_act() function in the net/sched/act_csum.c module of the network/sched subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcfcsumact function in the net/sched/actcsum.c module of the network/sched subsystem of the Linux operating system is related to the improper checking of the specified index, position, or offset in the input data. Exploiting this vulnerability may allow a remote attacker ...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2026-59084

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

CVE-2026-49844

A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layou...

CVE-2026-64284

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for x86 systems. This vulnerability occurs when KVM handles fastpath exits, where it may fail to execute vendor-specific cleanup operations before returning control to the virtual machine's userspace. Consequently, memory...

CVE-2026-64264

A flaw was found in the Linux kernel's FUSE Filesystem in Userspace component. An error handling vulnerability in the fuseuringcommit function allows a positive error code to overwrite a critical negative error, causing FUSE operations to be incorrectly reported as successful. This can lead to FU...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247

CVE-2026-59247 describes an integrity issue in Gleam where dependency resolution can be hijacked by a network attacker. During resolution, Gleam fetches signed repository metadata but then queries an unsigned API for release data and writes the outer_checksum and dependency names into manifest.to...

github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

CVE-2026-0667

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-0667

CVE-2026-0667 affects Schneider Electric SCADAPack RTUs (47xi, 47x, 57x) and RemoteConnect software. Root cause: insufficient testing of unusual or exceptional states. Attack over Modbus TCP could enable arbitrary code execution, DoS, and loss of confidentiality/integrity with high impact on conf...