PT-2026-73180

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

PT-2026-73431

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...

PT-2026-73410

A flaw in Node.js can cause dns.resolveAny Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records. Repeated triggering of this condition can lead to denial of service. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

PT-2026-73389

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

PT-2026-76639

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...

Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...

ROS-20260817-73-0201

The vulnerability in xrdp is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

ALSA-2026:55679 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...

ALSA-2026:55772 Important: haproxy security update

The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...

Debian dla-4743 : ironic-api - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4743 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4743-1 [email protected]...

RHEL 9 : haproxy (RHSA-2026:55802)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55802 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haprox...

Fortinet FortiClient Heap overflow in kernel driver due to missing size validation (FG-IR-26-156)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-156 advisory. - A buffer copy without checking size of input 'classic buffer overflow' vulnerability in Fortinet FortiClientWindows 7.4.0...

RHEL 10 : haproxy (RHSA-2026:55800)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55800 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes:...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099506 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the...

RHEL 9 : haproxy (RHSA-2026:55803)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55803 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haprox...

CVE-2026-19962 Edimax EW-7478APC setWAN command injection

A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has...

CVE-2026-19959

The vulnerability CVE-2026-19959 affects Edimax EW-7478APC with firmware 1.04, targeting the formWanTcpipSetup function. Crafted input to pppUserName leads to a stack-based buffer overflow in /goform/formWanTcpipSetup, enabling remote exploitation. Public exploit code exists, increasing risk of n...

CVE-2026-19957

The CVE concerns graphlit-mcp-server 1.0.1, specifically the ssrf-test Endpoint’s src/tools.ts fetch function. The root cause is manipulation of the url argument, enabling server-side request forgery (SSRF). Reported attack vector is network, with low attack complexity and no user interaction req...

PT-2026-73178

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...