How to Allow Company Users to Open Veeam Backup & Replication Web UI Wizards From Veeam Service Provider Console

Purpose This article documents how to allow company users to open Veeam Backup & Replication web UI wizards from Veeam Service Provider Console for backup servers managed by their company. Starting with Veeam Service Provider Console 9.3, users can perform restore operations by redirecting to the...

RHEL 9 : wget (RHSA-2026:62143)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62143 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Heap buff...

RHEL 8 : kernel (RHSA-2026:61932)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61932 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipv6: fix possible UAF in...

ALSA-2026:62142 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or denial of service via crafted...

RHEL 10 : libXfont2 (RHSA-2026:62123)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62123 advisory. X.Org X11 libXfont2 runtime library Security Fixes: libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679...

Important: php:7.4 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

Moderate: libssh security update

libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fixes: libssh: libssh: denial of service via zero advertised channel packet size CVE-2026-59843 libssh: libssh: denial of service via oversized SFTP read length CVE-2026-598...

Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

ALSA-2026:61887 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: seccomp: passthrough uretprobe systemcall without filtering CVE-2025-21834 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv CVE-2026-23003 kernel: netfilter: nftables: Fix for...

EasyAppointments 1.5.1 - Blind SQL Injection

Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection Google Dork: N/A backend login required Date: 07/27/2026 Exploit Author: Michael Chesang Vendor Homepage: https://easyappointments.org Software Link: https://github.com/alextselegidis/easyappointments/releases Version: = 1.5.1 REQUIRED...

SPIP 4.4.8 Insecure Deserialization

SPIP versions 4.4.0 through 4.4.8 contain an insecure deserialization vulnerability in the public area through the tablevaleur filter and DATA iterator. An attacker able to place malicious serialized content can trigger arbitrary object instantiation and potentially achieve remote code execution...

PT-2026-84152

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

PT-2026-84117

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

PT-2026-84099

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-84102

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product order' parameter in all versions up to, and including, 5.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2026-84554

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-84107

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an...

PT-2026-84115

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-84192

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Firefox ESR versions prior to 153.2 Thunderbird versions prior to 155 Thunderbird versions prior to 153.2 Description A clickjacking issue exists within the DOM: Events component. Clickjacking is a technique where...