PT-2026-83691

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When...

Important: libsoup3

Issue Overview: A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 SS5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote,...

Important: freerdp

Issue Overview: FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands...

PT-2026-83817

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

PT-2026-83793

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

CVE-2026-75460

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

Important: clamav1.5

Issue Overview: A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for...

RHEL 8 : xmlrpc-c (RHSA-2026:61235)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61235 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

SUSE SLES12 Security Update : kernel (Live Patch 84 for SUSE Linux Enterprise 12 SP5) (SUSE-SU-2026:3808-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3808-1 advisory. This update for the SUSE Linux Enterprise Kernel 4.12.14-122.317 fixes various security issues: The following security issues were fixed: -...

RHEL 7 : libssh2 (RHSA-2026:61752)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61752 advisory. The libssh2 packages provide a library that implements the SSH2 protocol. Security Fixes: libssh2: integer overflow via large username or...

RHEL 8 : pam (RHSA-2026:61224)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61224 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...

RHEL 10 : iscsi-initiator-utils (RHSA-2026:61679)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61679 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utilit...

RHEL 8 : NetworkManager (RHSA-2026:61239)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61239 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

RHEL 8 : xmlrpc-c (RHSA-2026:61236)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61236 advisory. XML-RPC is a remote procedure call RPC protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a...

The vulnerability of the GPU components in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the GPU components in Google Chrome and Microsoft Edge relates to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...

The vulnerability of the GPU components in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the GPU components in Google Chrome and Microsoft Edge browsers is related to buffer overflows in the stack. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created HTML page...

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge, which allows a hacker to trigger a service failure

The vulnerability of the Headless web browsers Google Chrome and Microsoft Edge is related to improper code generation. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created HTML page...

The vulnerability of the Glic component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Glic component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge web browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially created HTML page...