Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-129 (ALASKERNEL-5.10-2026-129)

The version of kernel installed on the remote host is prior to 5.10.262-262.1063. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2026-129 advisory. In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in...

Amazon Linux 2023 : wget (ALAS2023-2026-2047)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2047 advisory. GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memo...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101988)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101988 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Handle probe errors properly The probe procedure of setupcard in caiaq driver doesn'...

TencentOS Server 3: vim (TSSA-2026:0857)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0857 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-77134

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-WLC100 version 1v2.07b01 Description A stack-based buffer overflow exists in the HTTP Header Handler component within the /usr/nginx/sbin/nginx file. The issue occurs in the FUN 0040da4c function when the Server argument is...

Linux Distros Unpatched Vulnerability : CVE-2026-72128

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix refcount leak in nvmetsqcreate In nvmetsqcreate, a reference on the ctrl is taken via krefgetunlesszero before calling nvmetchecksqid. If...

Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26015)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26015 advisory. - Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting...

Linux Distros Unpatched Vulnerability : CVE-2026-72048

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ieee802154: ca8210: fix casctl leak on spiasync failure ca8210spitransfer allocates casctl with kzallocobjGFPATOMIC and relies entirely on the SPI completion...

Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26017)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26017 advisory. - Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code...

Nodemailer 9.0.0 - File Read/ SSRF

Exploit Title: Nodemailer 9.0.0 - File Read/ SSRF Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/nodemailer/nodemailer Software Link: https://www.npmjs.com/package/nodemailer Version: nodemailer or href: message is read ANYWAY, because...

PT-2026-77245

MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared func.py logs that an archive member exceeding ZIP MAX UNCOMPRESSED FILE SIZE is being skipped but does not continue to the next member, so an authenticated user...

PT-2026-76933

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

PT-2026-76887

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipulation of the argument delid results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be...

CVE-2021-43717

An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously...

PT-2026-77271

Name of the Vulnerable Software and Affected Versions Super Productivity versions prior to 18.13.0 Description The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer via the IPC.EXEC channel and executes it using the child process.exec function. The...

PT-2026-76934

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes preg match to return false for...

PT-2026-77292

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp actions function...

dyen macOS In-Memory Mach-O Loader

dyen is a macOS in-memory Mach-O dynamic library loader designed to execute a dylib using the stock Python interpreter without writing the decrypted Mach-O to disk or registering the payload with dyld. It supports encrypted standalone payloads and encrypted dylibs appended to otherwise valid cove...

PT-2026-76911

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. I...

PT-2026-78232

Name of the Vulnerable Software and Affected Versions Confidential Containers Guest Components versions 0.16.0 through 0.19.0 Description A crafted OCI image layer can cause the image rs::stream::unpack::unpack function to create a hardlink outside its intended destination directory. This occurs...