PT-2026-84266

httpd function check header/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

VulnCheck KEV: CVE-2026-78141

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

MAL-2026-15819 Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...

The vulnerability of the isPublicIP() function in the core/providers/utils/fetch.go file of the data-free synchronization software Bifrost allows a attacker to perform an SSRF attack.

The vulnerability of the isPublicIP function in the core/providers/utils/fetch.go file of the data-free synchronization software Bifrost is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a remote attacker to execute an SSRF attack...

PostgreSQL 14.x < 14.24 / 15.x < 15.19 / 16.x < 16.15 / 18.x < 18.6 amcheck Untrusted Search Path

The version of PostgreSQL installed on the remote host is 14 prior to 14.24, 15 prior to 15.19, 16 prior to 16.15, or 18 prior to 18.6. As such, it is potentially affected by a privilege escalation vulnerability: - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function...

TencentOS Server 2: 389-ds-base (TSSA-2026:0937)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0937 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

openSUSE 16: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (openSUSE-SU-2026:21700-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21700-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

Alibaba Cloud Linux 3 : 0277: cups-filters (ALINUX3-SA-2026:0277)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0277 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-64612: A flaw was found in libcupsfilters...

TencentOS Server 2: gnutls (TSSA-2026:0943)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0943 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

TencentOS Server 4: xmlrpc-c (TSSA-2026:0877)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0877 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: expat (TSSA-2026:0879)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0879 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-51741

Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51788

An issue in cleverangeauth v.0.1.10 allows a remote attacker to cause a denial of service via the accountverification function and the accounts/models.py component...

PostgreSQL 14.x < 14.24 / 15.x < 15.19 / 16.x < 16.15 / 17.x < 17.11 / 18.x < 18.6 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 14 prior to 14.24, 15 prior to 15.19, 16 prior to 16.15, 17 prior to 17.11, or 18 prior to 18.6. As such, it is potentially affected by multiple vulnerabilities: - Type confusion with PostgreSQL 'internal' data type arguments allows any us...

SPIP 4.4.8 Insecure Deserialization

SPIP versions 4.4.0 through 4.4.8 contain an insecure deserialization vulnerability in the public area through the tablevaleur filter and DATA iterator. An attacker able to place malicious serialized content can trigger arbitrary object instantiation and potentially achieve remote code execution...

Alibaba Cloud Linux 3 : 0263: python-idna (ALINUX3-SA-2026:0263)

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2026:0263 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-45409: Internationalized Domain Names in...

TencentOS Server 4: rust (TSSA-2026:0951)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0951 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Alibaba Cloud Linux 3 : 0269: libXfont2 (ALINUX3-SA-2026:0269)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0269 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-44950: A flaw was found in the...

AlmaLinux 9 : nodejs:24 (ALSA-2026:55603)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55603 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

PT-2026-84106

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the guest ticket login function and its p parameter...