PT-2026-71341

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to cross-site scripting when a crafted application/x-trix-document JSON payload is dropped into an editor using the fallback Level0InputController, such as an embedded WebView without...

PT-2026-71189

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote authenticated attackers can modify data in specific SQL tables. This is caused by improper neutralization of special elements used in an SQL command, a condition known as SQL injection, where...

PT-2026-71264

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration. req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without requiring the final request destination to match the datasource origin. An unauthenticated caller of ...

PT-2026-76554

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...

PT-2026-71309

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the...

TencentOS Server 3: maven:3.8 (TSSA-2026:0843)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0843 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-73089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct...

GitLab 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-18433)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to read policy...

RHEL 9 : ldns (RHSA-2026:54244)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:54244 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define...

RHEL 9 : ldns (RHSA-2026:54377)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:54377 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define...

Linux Distros Unpatched Vulnerability : CVE-2026-68088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a...

Debian dla-4736 : python-django-doc - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4736 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected]...

SUSE CVE-2026-68088

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndisqueryresponse, and perform a length check on them. This is identical to how rndissetresponse handle...

SUSE CVE-2026-68346

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from the returned object. However, the returned ACPI object is owned by the...

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-68820...

Microsoft and Adobe Patch Tuesday, August 2026 Security Update Review

The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services. As attackers continue to exploit unpatched vulnerabilities, timely patching remains critical for reducing exposure and strengthening enterprise...

Exploit for CVE-2025-10951

CVE-2025-10951 - checkmlloggertraversal.py Proof-of-existen...

Missing Authorization

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Missing Authorization in the AdminRenderer.render method. An attacker can access sensitive data by submitting an invalid write request, which triggers a 400 B...

SUSE-SU-2026:23068-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-23259: iouring/rw: free potentially allocated iovec on cache put failure bsc1259866. - CVE-2026-31443: dmaengine: idxd: Fix crash when the event log is disabled...

CVE-2026-66832

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...