PT-2026-97603

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An OS command injection flaw allows a remote authenticated attacker to execute arbitrary code on the system. Recommendations At the moment, there is no information about a newer...

PT-2026-97588

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Insufficient input sanitization of shell metacharacters in the CLI scripting component allows authenticated users to break out of restricted execution contexts on managed switches. An attacke...

CVE-2026-90902: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task administrator/index.php?option=comeasystore&task=coupon.couponBulkUpdate took input IDs and directly concatenated them into raw SQL I...

CVE-2026-95842: Uncaught Exception

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

PT-2026-97568

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description When no CA bundle is available, the ssl options/1 function fal...

PT-2026-97551

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...

CVE-2026-96454: Missing Authorization

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

PT-2026-97357

Name of the Vulnerable Software and Affected Versions web.py version 0.76 Description Server-side template injection SSTI occurs when the template engine is tricked into executing attacker-controlled template code, bypassing built-in security checks. This happens when an application precompiles...

PT-2026-97540

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description A flaw exists in the custom Credential Type environment-variable injector. The system validates variable names using a deny-list consisting of an...

PT-2026-97550

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description An argument-injection flaw exists in the system-job subsystem. The system-job template launch endpoint fails to perform integer validation on the...

PT-2026-97595

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

Linux Distros Unpatched Vulnerability : CVE-2026-93012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches...

RHEL 9 : libxml2 (RHSA-2026:70639)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70639 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow i...

RHEL 9 : postgresql:16 (RHSA-2026:70856)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70856 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

CVE-2026-95833: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-95829: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The...

CVE-2026-90901: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint administrator/index.php?option=comeasystore&task=media.deleteImage parsed the ids parameter as a comma-separated string and implode...

CVE-2026-84724: Improper Neutralization of Argument Delimiters in a Command

An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template launch endpoint stores a user-supplied "days" variable without running the integer validation defined elsewhere for that field, and the dispatcher flattens t...

PT-2026-97205

Name of the Vulnerable Software and Affected Versions Acer NitroSense versions prior to 5.2.63 Description An unauthenticated local attacker can connect to the MQTT broker via the localhost WebSocket endpoint. This access allows the invocation of exposed ddsc RPC functions, specifically the child...

PT-2026-97393

Name of the Vulnerable Software and Affected Versions Moquette versions prior to 0.18.1 Description In the SessionEventLoop.run function, only InterruptedException is caught, and the SessionEventLoopGroup fails to restart a terminated loop. An MQTT command that triggers an uncaught exception can...