EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2724)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871...

Amazon Linux 2 : yelp, --advisory ALAS2-2026-3821 (ALAS-2026-3821)

The version of yelp installed on the remote host is prior to 3.28.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3821 advisory. A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation provided by yelp-xsl. A malicious...

📄 WordPress Ajax Filter Posts (GridMaster) 3.4.11 Unauthenticated Local File Inclusion / Code Execution

WordPress Ajax Filter Posts GridMaster plugin version 3.4.11 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

PT-2026-63319

Name of the Vulnerable Software and Affected Versions accountsservice versions prior to 23.13.9-8ubuntu7 Description Ubuntu-specific language helper scripts, specifically save-to-pam-env and update-langlist, fail to properly sanitize the LANGUAGE entry within the /.pam environment file. This inpu...

📄 WordPress Category Ajax Filter 2.8.2 Unauthenticated Local File Inclusion / Code Execution

WordPress Category Ajax Filter plugin version 2.8.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2743)

According to the versions of the package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library...

EulerOS Virtualization 2.10.1 : cups (EulerOS-SA-2026-2815)

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in ...

Amazon Linux 2 : python3-pygments, --advisory ALAS2-2026-3817 (ALAS-2026-3817)

The version of python3-pygments installed on the remote host is prior to 2.2.0-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3817 advisory. A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file...

PT-2026-62202

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.12 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This can result in an unauthorized ability t...

PT-2026-62065

Name of the Vulnerable Software and Affected Versions Data::RingBuffer::Shared versions prior to 0.04 Description This issue occurs when a world-readable mmap backing file is created and opened without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode of...

EulerOS Virtualization 2.10.0 : dnsmasq (EulerOS-SA-2026-2848)

According to the versions of the dnsmasq package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary...

PT-2026-62622

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Command Center Framework version V16 Description An issue exists in the Core component of the Oracle Enterprise Command Center Framework. An unauthenticated attacker with access to the physical communication segment attached ...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Gitea's restore-repo command processes release.yml files from a user-supplied archive. The DownloadURL field in each release attachment is passed to uri.Open without scheme validation. Because uri.Open supports the file:// scheme via os.Open, an operator-level attacker can plant a crafted...

PT-2026-61956

Name of the Vulnerable Software and Affected Versions snap-confine affected versions not specified Description A local privilege escalation issue exists in snap-confine, a core component used by Canonical snapd to create secure execution environments for snap applications. The flaw occurs in...

PT-2026-61828

Name of the Vulnerable Software and Affected Versions kronosnet versions prior to 1.35 Description An issue exists in the cryptographic configuration management where the framework fails to zero-out or wipe sensitive memory segments after executing changes. This results in raw encryption keys...

PT-2026-63318

Name of the Vulnerable Software and Affected Versions AccountsService versions prior to 23.13.9-8ubuntu7 Description An Ubuntu-specific patch in the SetLanguage function only partially drops privileges before launching language helper scripts. While the effective UID/GID is changed to the target...

PT-2026-63271

Name of the Vulnerable Software and Affected Versions jsforce versions prior to 3.10.17 Description An OS command injection issue exists within the SFDX Connection Registry component. The flaw is located in the execCommand function within the lib/registry/sfdx.js library. This allows for the...

📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution

WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

PT-2026-61950

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

Linux Distros Unpatched Vulnerability : CVE-2026-15811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memor...