UBUNTU-CVE-2026-59997

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

EUVD-2026-42106

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollamabaseurl parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attack...

CVE-2026-59997

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

CVE-2026-59997

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

CVE-2026-59997

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection...

CVE-2026-59996

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...

The vulnerability of the Handlebars.compile() function, a tool for creating Handlebars templates, allows a malicious actor to cause a service failure.

The vulnerability of the Handlebars.compile function, a tool for creating Handlebars templates, is related to improper handling of code generation. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-56673

Name of the Vulnerable Software and Affected Versions Waku versions prior to 1.0.0-beta.1 Description The unstable redirect function exported from waku/router/server accepts an arbitrary string and reflects it unchanged into the HTTP Location response header without URL validation, scheme...

The vulnerability of the ets_qdisc_change() function in the net/sched/sch_ets.c module of the network/sched/sch_ets.c subsystem of the Linux operating system’s networking subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the etsqdiscchange function in the net/sched/schets.c file, within the net/sched subsystem of the Linux kernel’s network management mechanism, relates to operations involving resources after their expiration. Exploiting this vulnerability could allow an attacker to compromise...

The vulnerability of the gs_usb_xmit_callback() function in the drivers/net/can/usb/gs_usb.c file of the Linux kernel’s CAN network device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the gsusbxmitcallback function in the drivers/net/can/usb/gsusb.c file of the Linux network device driver module is related to the failure to release resources after their useful life has ended. Exploiting this vulnerability could allow an attacker to compromise the...

Adalo Database API Enables Cross-App User Data Extraction via Over-Fetching and Missing Authorization Controls

Overview Adalo’s no‑code application platform exposes complete user records through its database API for all applications built on both V1 and V2. Due to a platform-level flaw, authenticated users can retrieve full user data belonging to any Adalo application, regardless of configuration. This...

RHEL 8 : httpd:2.4 (RHSA-2026:36373)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:36373 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP...

Linux Distros Unpatched Vulnerability : CVE-2026-58266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Anki is a program for creating and reviewing flashcards. Prior to 25.09.4, Anki's webview-based pages communicate with the Rust backend using an internal...

PT-2026-56681

Summary async-tar v0.6.0 mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX extended-header record set to describe the next file entry, never an intervening...

Amazon Linux 2 : docker, --advisory ALAS2ECS-2026-131 (ALASECS-2026-131)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2026-131 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

ROS-20260708-73-0020

The vulnerability of the PostgreSQL database management system is related to the disclosure of information based on temporal discrepancies. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

PT-2026-61024

Name of the Vulnerable Software and Affected Versions xrdp versions prior to 0.10.6.1 Description An issue exists when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, as the Xvnc process is launched with insufficient authentication mechanisms. A local...

Important: ecs-init

Issue Overview: Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt ...

The vulnerability of the IPTCTEXT mechanism in the console-based ImageMagick graphic editor allows a hacker to trigger a service failure.

The vulnerability of the IPTCTEXT mechanism in the console-based ImageMagick graphic editor is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability can allow a malicious actor to cause service failures...