FreeBSD : njs -- heap buffer overflow in XML exclusive canonicalization (0bfb082c-a7b6-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0bfb082c-a7b6-11f1-a655-3497f65b111b advisory. F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when...

RockyLinux 10 : buildah (RLSA-2026:63332)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:63332 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 net/mail: golang: net/mai...

The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.

The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

The vulnerability of Fortinet FortiWeb web applications’ network firewalls, related to authentication procedures that allow attackers to bypass existing security restrictions.

The vulnerability of Fortinet FortiWeb network firewalls is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to bypass existing security restrictions remotely...

PT-2026-86264

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to the delete pools endpoint to irreversibly destroy every host pool, removing traff...

PT-2026-85480

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

PT-2026-85497

Traefik before v2.11.55 contains a TLS option conflict resolution vulnerability that allows unauthenticated attackers to bypass client-certificate authentication by creating conflicting TLS options on multi-host routers. Attackers can reach protected backends by exploiting shared TLS resolution...

PT-2026-85544

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...

Joern 4.0.618

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106162)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106162 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106160 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges...

PT-2026-85808

undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Because the internal cache key falls back to an empty origin string, a cacheable or in-flight response from one upstream...

CVE-2026-84185

A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...

CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...

PT-2026-85506

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

UBUNTU-CVE-2026-80731

In the Linux kernel, the following vulnerability has been resolved: net: remove CAPSYSRAWIO zero-padding in devvalidateheader devvalidateheader reads dev-hardheaderlen directly when zero-padding short link layer headers for CAPSYSRAWIO holders: if capableCAPSYSRAWIO memsetllheader + len, 0,...

PT-2026-86222

Name of the Vulnerable Software and Affected Versions Nango versions prior to 0.71.6 Description The runner tRPC server contains a missing authentication flaw that allows unauthenticated attackers with network access to the runner port to execute arbitrary JavaScript code. This is achieved by...

Flextype CMS 1.0.0-alpha.3 Authentication Bypass

Flextype CMS version 1.0.0-alpha.3 contains an authentication validation vulnerability in the API request-processing functionality. API endpoints may declare accesstoken as a required parameter, but the required-parameter validation only verifies that the corresponding key exists in the supplied...

Payara 7.2026.1.RC1 Arbitrary EJB Method Invocation

Payara Server exposes multiple HTTP-accessible EJB invocation mechanisms that rely on attacker-controlled reflection, dynamic class loading, and unsafe deserialization. These endpoints allow remote clients to perform arbitrary JNDI lookups, resolve attacker-supplied class names, and invoke EJB...