PT-2026-1508

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.20 GitHub Enterprise Server versions 3.14.20 GitHub Enterprise Server versions 3.15.15 GitHub Enterprise Server versions 3.16.11 GitHub Enterprise Server versions 3.17.8 GitHub Enterprise Server...

PT-2026-1522

Name of the Vulnerable Software and Affected Versions Progress MOVEit Transfer versions 2022.0.0 through 2022.0.10 Progress MOVEit Transfer versions 2022.1.0 through 2022.1.11 Progress MOVEit Transfer versions 2023.0.0 through 2023.0.8 Progress MOVEit Transfer versions 2023.1.0 through 2023.1.3...

PT-2026-1503

Name of the Vulnerable Software and Affected Versions iccDEV versions prior to 2.3.1.2 Description iccDEV is a set of libraries and tools for interacting with International Color Consortium ICC color management profiles. A flaw exists in versions prior to 2.3.1.2 that can lead to a heap buffer...

SUSE: Security Advisory (SUSE-SU-2026:0022-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-1361

Name of the Vulnerable Software and Affected Versions Pterodactyl versions 1.11.11 and below Description Pterodactyl, a game server management panel, has an issue where Time-based One-Time Password TOTP can be reused during its validity window. When a user with two-factor authentication 2FA enabl...

PT-2026-1366

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description A flaw exists in Modem that may cause a system crash due to improper error handling. This could result in a remote denial of service if a User Equipment UE connects to a malicious base station...

PT-2026-1483

Name of the Vulnerable Software and Affected Versions Tickera versions through 3.5.6.4 Description A missing authorization issue exists in Tickera tickera-event-ticketing-system, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Tickera to a...

PT-2026-1474

Name of the Vulnerable Software and Affected Versions BoldGrid Post and Page Builder versions through 1.27.9 Description An authorization issue exists in BoldGrid Post and Page Builder. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized...

PT-2026-1490

Name of the Vulnerable Software and Affected Versions CyberChimps Responsive Addons for Elementor versions through 2.0.8 Description The software contains a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Responsi...

Fedora: Security Advisory (FEDORA-2025-ec760de8e2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-1478

Name of the Vulnerable Software and Affected Versions Themepoints Accordion versions through 3.0.3 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting XSS issue. This allows for the injection ...

PT-2026-1476

Name of the Vulnerable Software and Affected Versions CoolHappy The Events Calendar Countdown Addon versions through 1.4.15 Description The CoolHappy The Events Calendar Countdown Addon has a flaw due to incorrectly configured access control security levels, leading to a missing authorization...

PT-2026-1436

Name of the Vulnerable Software and Affected Versions AirVPN Eddie version 2.24.6 Description The software contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root. Recommendations Update to a newer version that contains a fix for this...

openSUSE Security Advisory (SUSE-SU-2026:0022-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2026-1481

Name of the Vulnerable Software and Affected Versions Proxy & VPN Blocker versions through 3.5.3 Description An authorization issue exists in Proxy & VPN Blocker that allows exploitation of incorrectly configured access control security levels. Recommendations Update Proxy & VPN Blocker to a...

GHSA-M9RG-MR6G-75GM `vega-functions` vulnerable to Cross-site Scripting via `setdata` function

Impact For sites that allow users to supply untrusted user input, malicious use of an internal function not part of the public API could be used to run unintentional javascript XSS. Patches Fixed in vega-functions 6.1.1 Workarounds There is no workaround besides upgrading. Using...

`vega-functions` vulnerable to Cross-site Scripting via `setdata` function

Impact For sites that allow users to supply untrusted user input, malicious use of an internal function not part of the public API could be used to run unintentional javascript XSS. Patches Fixed in vega-functions 6.1.1 Workarounds There is no workaround besides upgrading. Using...

EUVD-2025-206236

vega-functions vulnerable to Cross-site Scripting via setdata function...

Server-side Request Forgery (SSRF)

Overview io.spinnaker.orca:orca-clouddriver is a Spinnaker Orca Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper restrictions on user-supplied URLs when fetching data. An attacker can access internal resources, extract sensitive authentication data...

CVE-2025-66648

vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function not part of the public API could be used to run unintentional javascript XSS. This issue is...