PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

PT-2026-66560

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An SSRF Server-Side Request Forgery and local file read issue exists in the multimodal generation endpoint '/v1/chat/completions'. This occurs because the image url variable is not properly...

PT-2026-66330

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. Chromium security severity: Low...

Adobe Bridge authorization issue vulnerability (CNVD-2026-30875)

Adobe Bridge is a digital asset management and file organization tool developed by the American company Adobe. Adobe Bridge has vulnerabilities related to authorization; attackers can exploit these vulnerabilities to gain unauthorized read/write permissions...

PT-2026-66625

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The MMS server connection handler contains a flaw in the processing of BER-encoded request data. When an MMS confirmed request PDU Protocol Data Unit containing ...

Linux Distros Unpatched Vulnerability : CVE-2026-17946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain potentially...

PT-2026-66604

Name of the Vulnerable Software and Affected Versions re2 versions prior to 1.25.2 Description The software validates lastIndex against the UTF-8 byte length of a subject but incorrectly uses it as a UTF-16 code-unit offset in the exec, test, match, replace, and split functions. When a non-ASCII...

Linux Distros Unpatched Vulnerability : CVE-2026-64685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for...

PT-2026-66594

Name of the Vulnerable Software and Affected Versions GoAccess versions prior to 1.11 Description The parse ios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove. This allows a crafted User-Agent in a processed access log to read...

Oracle Linux 10 : openssh (ELSA-2026-47757)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-47757 advisory. - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed in unintended parent directories when scp performs remote-to-remote copy...

Linux Distros Unpatched Vulnerability : CVE-2026-17745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a...

PT-2026-66091

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An out of bounds read exists in WebGL, which allows a remote attacker to perform an out of bounds memory read by inducing the user to visit a crafted HTML page. An out of bounds read...

Adobe Bridge path traversal vulnerability

Adobe Bridge is a digital asset management and file organization tool developed by the American company Adobe. Adobe Bridge has a path traversal vulnerability, which stems from improper path handling. Attackers can exploit this vulnerability to allow arbitrary file system reads...

PT-2026-66484

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability...

EUVD-2026-50571

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location so a crafted image could result in an heap buffer over-read. This issue has been fixed in version...

Important: Red Hat Security Advisory: openssh security update

An update for openssh is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories...

CVE-2026-50782

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/spmanagergetUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

CVE-2026-67439

CVE-2026-67439 affects OliveTin prior to 3000.17.0. The StartActionAndWait and StartActionByGetAndWait endpoints in service/internal/api/api.go return full LogEntry output after execution without enforcing the logs permission, enabling a user with exec permission but logs:false to read action out...