PT-2026-99069

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An attacker can craft a URL for a dashboard that reflects attacker-controlled markup due to insufficient output encoding. A user who opens this crafted URL triggers reflected cross-site scripting...

Linux Distros Unpatched Vulnerability : CVE-2026-98139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock...

CVE-2026-98139: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ntfs: only count successfully cleared runs when freeing clusters ntfsclusterfreefromrlnolock adds a run's length to nrfreed whenever the error bookkeeping condition is false, which includes cases where ntfsbitmapclearrun actually...

The vulnerability of the pgAdmin 4 database management tool lies in the lack of mechanisms for encoding or shielding output data, allowing attackers to execute arbitrary code.

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the pgAdmin 4 database management tool lies in the lack of mechanisms for encoding or shielding output data, allowing attackers to execute arbitrary code.

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

EUVD-2026-66225

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands Incomplete fix of CVE-2026-46345...

Directory Traversal

Overview compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models Affected versions of this package are vulnerable to Directory Traversal via the --output argument in the author catalog, author prof, author ssp, create, and replicate commands, whi...

CVE-2026-61732

Versions prior to 1.1.17 of Decepticon , an autonomous hacking agent, are vulnerable to a role-boundary forgery because they fail to neutralize ChatML special-token literals when wrapping web crawl results into LLM messages. When using the BYOK deployment model with common providers (such as vLLM...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-56744

"@bsv/wallet-toolbox" provides BRC-100 wallet signing and storage components, while "@bsv/wallet-toolbox-client" and "@bsv/wallet-toolbox-mobile" provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes...

CVE-2026-56744

The @bsv/wallet-toolbox , @bsv/wallet-toolbox-client , and @bsv/wallet-toolbox-mobile packages contain a vulnerability where transactions created via a remote StorageClient do not verify that output locking scripts from the provider match the caller's requested outputs. A compromised provider cou...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)

@bsv/wallet-toolbox provides BRC-100 wallet signing and storage components, while @bsv/wallet-toolbox-client and @bsv/wallet-toolbox-mobile provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transaction...

CVE-2026-96873

The Mediawiki - CirrusSearch extension is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This issue specifically affects versions through 1.46.0 . While the CVSS 4.0 score indicates a Medium severity with ...

CVE-2026-96873 Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0...

CVE-2026-96873 Reflected XSS in CirrusSearch debug explain output

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0...

PT-2026-98120

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pinctrl mediatek paris component where the functions pinctrl gpio direction input and pinctrl gpio direction output acquire the pinctrl mutex. This requirement...

PT-2026-104874

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pt event stop is called without PERF EF UPDATE flag, then perf aux output end is not called. A subsequent call to pt event start will call perf aux output begin again which...

CVE-2026-77285

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...