RockyLinux 9 : image-builder (RLSA-2026:65886)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65886 advisory. crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32281 crypto/x509: crypto/tls: golang: Go:...

JetBrains YouTrack < 2026.2.18634 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18634. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation. CVE-2026-86482 - In JetBrains YouTrack befo...

MiracleLinux 8 : microcode_ctl-20260812-1.el8_10 (AXSA:2026-1799:07)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1799:07 advisory. kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2025-35973 kernel: microcodectl: Intel Xeon 6...

MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability

MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation...

PT-2026-89458

🚨 CVE-2026-88924 A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown function on a pathname inside a user-controlled directory. A local attacker can exploit this via a...

PT-2026-89301

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

PT-2026-89637

🚨 CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local std...

Unity Linux 20.1070e Security Update: mysql (UTSA-2026-022361)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022361 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0...

JetBrains YouTrack < 2026.1.14047 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.1.14047. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

MikroTik RouterOS 6.x < 6.49.21 / 7.0.x < 7.23.4 / 7.24.x < 7.24.2 Multiple Vulnerabilities

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 6.x prior to 6.49.21, or 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by multiple vulnerabilities : - RouterOS accepts a 'related' btest connection before...

Linux Distros Unpatched Vulnerability : CVE-2026-88924

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the...

corosync-3.1.10-5.1 on GA media (moderate)

corosync-3.1.10-5.1 on GA media Announcement ID: openSUSE-SU-2026:11715-1 Rating: moderate Cross-References: CVE-2026-81665 CVE-2026-81666 CVSS scores: CVE-2026-81665 SUSE : 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-81665 SUSE : 7.7...

PT-2026-89261

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including...

PT-2026-89590

🚨 CVE-2026-9176 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker could exploit this vulnerability to escalate privileges and gain unauthorized access to protected resources. 🎖@cveNotify...

PT-2026-89495

New Plesk security alert: a symlink race condition in Backup Manager CVE-2026-68488 allows users with just FTP and panel access to gain root on Linux servers. Affects Plesk for Linux versions 18.0.80.6- and 18.0.79.10- branches. Patch to 18.0.80.7+ or 18.0.79.11+, especially if you run shared or...

PT-2026-89283

Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITYSYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

PT-2026-89260

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK EDITOR permission to plant a VQL...

PT-2026-89365

There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...

PT-2026-89374

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/ backend/private/invite new user to org.ts. The POST /private/invite new user to org endpoint only requires the org.update...

389-ds:1.4 security, bug fix, and enhancement update

1.4.3.39-28 - Bump version to 1.4.3.39-28 - Resolves: RHEL-222326 - EMBARGOED CVE-2026-18453 389-ds:1.4/389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USEONEBACKEND control in opsharedsearch rhel-8.10.z - Resolves: RHEL-220511 - EMBARGOED CVE-2026-1835...