BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA

BeyondTrust has released updates to address a critical security flaw impacting Remote Support RS and Privileged Remote Access PRA products that, if successfully exploited, could result in remote code execution. "BeyondTrust Remote Support RS and certain older versions of Privileged Remote Access...

The vulnerability of the iFlightDoc onboard documentation system, which stems from the use of pre-installed credentials, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the iFlightDoc onboard documentation system is related to the use of pre-set credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

JetBrains YouTrack 日志信息泄露漏洞

JetBrains YouTrack is a browser-based error tracking and project management software developed by Czech company JetBrains. This software features error tracking, workflow creation, and project progress monitoring. Versions of JetBrains YouTrack prior to 2025.3.119033 contained a log information...

PowerDocu 代码问题漏洞

PowerDocu is a canvas generation software developed by Rene Modery. Versions of PowerDocu prior to 2.4.0 had code vulnerabilities. These vulnerabilities stemmed from blindly trusting the $type attribute during the parsing of JSON files, which could lead to code execution...

PT-2026-7167

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.57.1 Description File Browser offers a file management interface for tasks like uploading, deleting, previewing, renaming, and editing files. A flaw in the password validation process, specifically a...

PT-2026-7114

Name of the Vulnerable Software and Affected Versions BeyondTrust affected versions not specified CyberArk Conjur versions prior to 15.2.0 Description A critical flaw exists that allows for pre-authentication remote code execution. The issue affects enterprise vaults and allows privilege escalati...

PT-2026-7153

Name of the Vulnerable Software and Affected Versions Faraday versions prior to 2.14.1 Description Faraday is an HTTP client library abstraction layer. A flaw exists in the build exclusive url method located in lib/faraday/connection.rb due to the use of Ruby’s URImerge function. This allows an...

Apache Shiro 安全漏洞

Apache Shiro is the United States Apache Apache Foundation set of Java security framework for performing authentication, authorization, encryption and session management . An authentication bypass vulnerability exists in Apache Shiro versions prior to 2.0.7. The vulnerability stems from an...

VulnCheck KEV: CVE-2026-1731

BeyondTrust Remote Support RS and Privileged Remote Access PRAcontain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system commands in the context of the site user. Successful exploitation requires no...

Roundcube Webmail 安全漏洞

Roundcube Webmail is an open-source browser-based IMAP client developed by Roundcube. It supports address book management, information search, spelling checking, and more. Versions of Roundcube Webmail prior to 1.5.13, as well as versions 1.6 through 1.6.13, had security vulnerabilities. These...

PT-2026-6940

Name of the Vulnerable Software and Affected Versions Xiaopi Panel versions prior to 20260127 Description A security flaw exists in Xiaopi Panel. The issue impacts an unknown function of the file /demo.php within the WAF Firewall component. Manipulation of the ID argument can lead to SQL injectio...

WeKan 安全漏洞

WeKan is an open-source dashboard application developed by WeKan. Versions of WeKan prior to 8.20 contained security vulnerabilities. These vulnerabilities were caused by improper handling of the Rules Handler component’s file server/publications/rules.js file, which could lead to lack of...

CVE-2026-25567 WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

WeKan versions prior to 8.19 contain an insecure direct object reference IDOR in the card comment creation API. The endpoint accepts an authorId from the request body, allowing an authenticated user to spoof the recorded comment author by supplying another user's identifier...

CVE-2026-25561 WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers such as boardId, cardId, swimlaneId, and listId are consistent and refer to a coherent card/board relationship, enabling attempts to upload...

CVE-2026-23740

A flaw was found in Asterisk. When the astcoredumper writes its gdb init and output files to a world-writable directory, a local attacker with write permissions to that directory can exploit this vulnerability. By manipulating the gdb init file and output paths, the attacker can cause the system ...

CVE-2025-64175

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code e.g., from their own account to...

Exploit for Code Injection in Ivanti Endpoint_Manager_Mobile

CVE-2026-1281 & CVE-2026-1340 - Ivanti EPMM Pre-Auth RCE !L...

EUVD-2026-5559

BeyondTrust Remote Support RS and certain older versions of Privileged Remote Access PRA contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the...

PT-2026-6919

Name of the Vulnerable Software and Affected Versions JeecgBoot versions prior to 3.9.0 Description A path traversal weakness exists in JeecgBoot. This issue affects some unknown functionality of the file /airag/knowledge/doc/edit within the Retrieval-Augmented Generation Module. Manipulation of...

PT-2026-6932

Name of the Vulnerable Software and Affected Versions Tenda G300-F router firmware versions prior to 16.01.14.2 Description The Tenda G300-F router firmware contains an OS command injection issue in the WAN diagnostic functionality, specifically within the formSetWanDiag function. The software...