PT-2026-76777

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

PT-2026-76821

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description An unauthenticated Server-Side Request Forgery SSRF exists in the MLflow Tracking Server. The POST /api/2.0/mlflow/webhooks/id/test endpoint allows an attacker to make the server issue HTTP requests ...

Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

PT-2026-73405

A flaw in Node.js Permission Model enforcement allows trace events.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and...

ALSA-2026:55858 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Important: firefox

Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. CVE-2026-16349 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firef...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101100 advisory. Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and...

Oracle Linux 10 : curl (ELSA-2026-55432)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55432 advisory. - fix proxy environment variable change detection CVE-2026-8927 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer token leak...

RHEL 9 : bind (RHSA-2026:55441)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55441 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

Important: firefox

Issue Overview: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. CVE-2026-16349 Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firef...

PT-2026-76641

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

Unity Linux 20.1050e / 20.1070-8ae / 20.1070e Security Update: openjpeg2 (UTSA-2024-003847)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-003847 advisory. A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101322)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101322 advisory. Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. Tenable h...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101145 advisory. Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101157 advisory. Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099902 advisory. In the Linux kernel, the following vulnerability has been resolved: audit: add missing syscalls to read class The at variant of getxattr and listxattr are missing fr...

PT-2026-73213

A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management/execute of the component Configuration Management. The manipulation of the argument action results in authorization bypass. The attack ma...

PT-2026-73198

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such...

PT-2026-76614

openssl encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rat...

PT-2026-73236

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an ActiveMQ temporary composite destination whose physical name is a comma-separated composite of real...