EUVD-2026-67767

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-83160

A flaw was found in the file-ico plugin in GIMP. When processing a specially crafted ICO image file, the plugin does not properly validate the used clrs palette count parameter. This incorrect validation leads to improper memory bounds checking, resulting in a heap out-of-bounds read. This issue...

PT-2026-83297

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: log4j12 (UTSA-2026-093024)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093024 advisory. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. T...

Linux Distros Unpatched Vulnerability : CVE-2026-80607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tracing/probes: Remove WARNONONCE from parsebtfarg Sashiko found that user can cause this WARNONONCE easily with adding a kprobe event based on a raw address wi...

PT-2026-83286

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

PT-2026-83008

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix missing mem scrub at clear key import in cca clr2cipherkey The helper function ip cprb helper uses internal buffer memory for building and processing CPRBs. After use this buffer was never scrubbed which could le...

Linux Distros Unpatched Vulnerability : CVE-2026-82343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count...

Linux Distros Unpatched Vulnerability : CVE-2026-80708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/zcrypt: Fix missing mem scrub at clear key import in ccaclr2cipherkey The helper function ipcprbhelper uses internal buffer memory for building and...

PT-2026-82878

The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's' parameter of the Advanced Search REST endpoint in all versions up to, and including, 4.10.1 due to insufficient input sanitization and output escaping. The REST endpoint at...

PT-2026-83261

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of parameter or argument delimiters allows an unauthorized attacker to execute arbitrary code over a network. Recommendations At the moment, ther...

CVE-2026-50979

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-82879

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2026-83365

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.7.6 IGEL OS 11 versions prior to 11.11.150 Description An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsign...

openSUSE 16: sequoia-sq / sequoia-sq-bash-completion / etc (openSUSE-RU-2026:21658-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- RU-2026:21658-1 advisory. Changes in sequoia-sq: - Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only LICENSE.txt confirms it Correct Legal-Review-Notice usa...

PT-2026-83073

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm backups path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2026-83134

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter...

PT-2026-83317

A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...

PT-2026-83350

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 6.3.12 Graylog versions prior to 7.0.7 Graylog versions prior to 7.1.2 Description An insecure direct object reference IDOR exists in the token revocation process. An authenticated user can delete access tokens...