PT-2026-105129

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

CVE-2026-51878: Improper Access Control

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...

ROS-20261001-73-0046

The vulnerability in rclone is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20261001-73-0048

The vulnerability in rclone relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2026-105825

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load openapi spec async of the file litellm/proxy/ experimental/mcp server/openapi to mcp generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec pa...

ROS-20261001-73-0023

The vulnerability in glib2 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-103799

Name of the Vulnerable Software and Affected Versions Ghost versions 5.2.0 through 6.61.0 Description An unauthenticated remote attacker can abuse the Stripe Checkout flow to attach a paid subscription to an existing member and modify that member's name. This process allows the injection of conte...

PT-2026-105830

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user api key auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

ROS-20261001-73-0052

The vulnerability in rclone relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2026-105831

A vulnerability was identified in BerriAI litellm up to 1.82.2. This impacts the function get redirect response from openid of the file litellm/proxy/management endpoints/ui sso.py of the component SSO Authentication Flow. The manipulation leads to session expiration. The attack is possible to be...

PT-2026-103654

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.2 Description A remote attack can be launched by manipulating the type attr argument in the setcos construct fci 44 function within the src/libopensc/card-setcos.c file, leading to a stack-based buffer overflow. A...

Rocky Linux 8 [CIQ] Security Update: perl-Convert-ASN1 (crlsa-2024_3049)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20243049 advisory. perl-Convert-ASN1: allows remote attackers to cause an infinite loop via unexpected input CVE-2013-7488 Tenable has extracted the preceding description block direct...

CVE-2026-63292: Stack-based Buffer Overflow

Stack-based buffer overflow in modvhostalias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when...

Rocky Linux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788339545)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788339545 advisory. - Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more...

AlmaLinux 9.6 [TuxCare] Security Update: elfutils / elfutils-debuginfod / elfutils-debuginfod-client / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765289483)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765289483 advisory. - A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function...

CentOS Linux 8.5 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (CENTOS8.5:CLSA-2025:1747855200)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1747855200 advisory. - A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certa...

CentOS Linux 6 [TuxCare] Security Update: libsmbclient / libsmbclient-devel / samba / samba-client / etc (CENTOS6:CLSA-2026:1778493573)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778493573 advisory. - Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.6:CLSA-2026:1784807256)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784807256 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exist...

PT-2026-103863

Name of the Vulnerable Software and Affected Versions rhukster dom-sanitizer versions prior to 1.0.16 Description A flaw in the URL Validation component allows remote attackers to cause cross site scripting. The issue resides in the DOMSanitizer::isDangerousUrl function within the...