The vulnerability of the Query Engine component of the Loki logging aggregation and storage system allows a attacker to trigger a service failure.

The vulnerability of the Query Engine component of the Loki logging aggregation and storage system is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2026-76561

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

PT-2026-76553

Impact Authenticated Backend Users with the backend.manage editor "Manage editor settings" permission can provide custom styles through Settings → Editor Settings → Markup Styles that are compiled through the LESS CSS parser and rendered on every backend page. Previously, the compiled output was...

PT-2026-75948

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

PT-2026-70978

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the export book method in t...

PT-2026-75930

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...

PT-2026-76560

Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and , which remain active LIKE...

PT-2026-71261

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers c...

Weaponized AI: The Commoditization of Cybercrime

Weaponized AI: The Commoditization of Cybercrime By Jambul Tologonov · August 12, 2026 Executive Summary The Trellix Advanced Research Center has been actively monitoring dark web forums and criminal communication channels for emerging threats tied to artificial intelligence AI. What we are...

MiracleLinux 9 : maven:3.9 (AXSA:2026-1516:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1516:01 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description bloc...

Linux Distros Unpatched Vulnerability : CVE-2026-15565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000162877)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000162877 advisory. NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability when handling replies with very large RRsets...

PT-2026-71320

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query...

PT-2026-71339

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download export method. By using ../ sequences, an attack...

PT-2026-71030

The ProSolution WP Client WordPress plugin before 2.0.9 does not validate a user-supplied URL, and does not check the capability or nonce of the requester, before performing a server-side HTTP request with it, allowing any authenticated user, such as a subscriber, to make the site issue arbitrary...

PT-2026-75979

Impact Affected versions of Winter CMS did not validate the handler name submitted through the form postback mechanism handler POST field in the same way as AJAX requests X WINTER REQUEST HANDLER header. The AJAX path validates that handler names match the onA-Zw+ pattern, but the postback path...

PT-2026-71341

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

PT-2026-71189

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can modify data in specific SQL tables. This is caused by improper neutralization of special elements used in an SQL command, a condition known as SQL injection, where...

PT-2026-71264

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration. req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of ...

PT-2026-76554

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...