PT-2026-70875

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in...

PT-2026-70858

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...

PT-2026-70853

An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a mongos router process to terminate unexpectedly by submitting a specially formed aggregation command. This could result in a denial of service, disrupting client connections routed through the...

PT-2026-70196

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

PT-2026-70854

An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to perform an action against protected system collections that should require more specific privileges. This could result in exposure of collection metadata and, on certain deployment configurations,...

PT-2026-70479

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description An integer underflow wrap or wraparound occurs in the Windows DHCP Server, which allows an unauthorized attacker to disclose sensitive information over an adjacent network...

PT-2026-70860

An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different, protected view over the same underlying collection. This is due to insufficient handling of certain user-supplied fields when constructin...

PT-2026-70599

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to cause a denial of service over a network. Deserialization is the process of converting a data stream back...

PT-2026-70554

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description An integer underflow wrap or wraparound occurs in the Windows DHCP Server, which could allow an unauthorized attacker to disclose sensitive information over an adjacent network an...

PT-2026-70062

Name of the Vulnerable Software and Affected Versions mcp-grafana versions prior to 1.1.0 Description An authentication bypass allows unauthenticated attackers to use self-generated session IDs to gain access to the server's Grafana service account. This can be chained with a server-side request...

KB5120238: Windows 10 version 1809 / Windows Server 2019 Security Update (August 2026)

The remote Windows host is missing security update 5120238. It is, therefore, affected by multiple vulnerabilities - Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. CVE-2026-62878 - Use after free in Windows Deployment Services allows an...

PT-2026-70601

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

PT-2026-70505

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description An integer underflow wrap or wraparound occurs in the Windows DHCP Server, which allows an unauthorized attacker to disclose sensitive information over an adjacent network...

PT-2026-70107

Name of the Vulnerable Software and Affected Versions Command Center affected versions not specified Description A legacy endpoint in Command Center contains an unauthenticated server-side request forgery SSRF flaw. This issue occurs due to the improper handling of arbitrary target URLs, which...

PT-2026-70849

An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution o...

PT-2026-70839

An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able to issue aggregation and memory-management commands to cause an internal reference to be used after the underlying memory has been freed. This could result in a server crash or, potentially, executi...

PT-2026-70477

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description An integer underflow wrap or wraparound occurs in the Windows DHCP Server, which allows an unauthorized attacker to disclose sensitive information over an adjacent network...

PT-2026-70157

Nuxt versions = 4.4.7 and = 3.21.7 and 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json. The endpoint's local-request gate isLocalDevRequest is header-based and trusts the...

PT-2026-70841

OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get users, /user/get all users uid, and /group/get groups. Attackers can explo...