PT-2026-78364

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or within an extracted archive. If the filename contains a single quote...

PT-2026-78363

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software fails to sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or within an extracted archive using a name that contains a single quote followed by shel...

PT-2026-78362

Name of the Vulnerable Software and Affected Versions nnn version 5.2 Description The software stores the homelen variable as a uchar t, which limits its range to 0-255. An attacker capable of influencing the execution environment can provide a HOME path with a length that is truncated to 0. This...

CVE-2026-76919: Use of Uninitialized Variable

ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

PT-2026-78650

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.75 Description An authenticated user with attachment upload privileges can execute arbitrary commands as the Wekan server process on deployments where an external scanner is configured. The issue occurs in...

PT-2026-78560

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description In the libfreerdp/codec/planar.c file, the functions planar decompress plane rle and planar decompress plane rle only verify the existence of a control byte but fail to confirm if the source buffer...

PT-2026-78601

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description An integer underflow in the IPv4 IP-options parser allows a remote attacker to obtain sensitive information. An integer underflow occurs when an arithmetic operation results...

PT-2026-78487

Name of the Vulnerable Software and Affected Versions Grav Login Plugin versions prior to 3.8.11 Description The login.regenerate2FASecret task fails to verify if a user is authorized, checking only for the existence of a pending-session user. An attacker who has obtained a victim's password can...

CVE-2026-76919: Use of Uninitialized Variable

ESS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

PT-2026-78646

Name of the Vulnerable Software and Affected Versions Logto Tunnel versions prior to 0.3.9 Description The Logto Tunnel npm package contains a flaw where the createStaticFileProxy function in packages/tunnel/src/commands/tunnel/index.ts processes static asset requests using path.joinstaticPath,...

PT-2026-83510

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNG URL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNG URL, including its username and password, is sent to the client through an MC...

PT-2026-78652

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.90 Description An issue exists where the isFileValid function in models/fileValidation.js relies on the Unix file command for content-based MIME detection. When the file binary is unavailable, the detectMimeFromFile...

PT-2026-80735

Summary export space and import space tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host —...

PT-2026-78645

Name of the Vulnerable Software and Affected Versions Logto versions 1.40.1 through 1.40.9 Description In the .github/workflows/commitlint.yml file, the github.event.pull request.title variable is directly interpolated into an inline echo command. A pull request title containing a single quote ca...

CVE-2026-65611: Improper Neutralization of Special Elements used in an OS Command

nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...

PT-2026-78485

Name of the Vulnerable Software and Affected Versions Grav API Plugin versions prior to 1.0.6 Description An issue exists where the ApiKeyManager::generateKey function stores a declared scopes array, but the ApiKeyAuthenticator::authenticate function fails to read the keyDatascopes variable and...

PT-2026-80207

Summary export space and import space tools in @contentful/mcp-tools accept LLM-controlled host and proxy parameters that are spread directly into the options object passed to contentful-export / contentful-import. These libraries pass the merged options — including the attacker-controlled host —...

PT-2026-80780

Name of the Vulnerable Software and Affected Versions hpack versions prior to 4.2.0 Description Unbounded variable integer decoding can cause run-away computation when processing malformed input, resulting in On^2 runtime. This can effectively block further processing if the unsanitized input is...

PT-2026-78541

Name of the Vulnerable Software and Affected Versions Grafana OSS version 13.0.1 Description An authenticated low-privileged user with permissions to create or edit alert rules in a folder can bypass datasource permission enforcement. By setting the client-controlled queryType variable to expr...

Oracle Linux 10 : curl (ELSA-2026-55450)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory. - fix proxy environment variable change detection CVE-2026-8927 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer...