PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

Devolutions Server 2026.1.x < 2026.1.24.0 / 2026.2.x < 2026.2.14.0 Multiple Vulnerabilities (DEVO-2026-0026)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.23.0 or 2026.2.4.0 through 2026.2.12.0. It is, therefore, affected by multiple vulnerabilities, including: - Improper access control in the role membership management endpoint in Devolutions Server allows a...

PT-2026-66535

IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries...

PT-2026-66477

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.1.2.0 through 6.1.2.7 2 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through...

The vulnerability of the `ksmbd_kthread_fn()` function in the `fs/smb/server/transport_tcp.c` module, which is part of the SMB server support in Linux kernel, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the ksmbdkthreadfn function in the fs/smb/server/transporttcp.c module of the SMB server support module in the Linux operating system involves the disclosure of confidential information. Exploiting this vulnerability could allow an attacker, acting remotely, to gain...

Linux Distros Unpatched Vulnerability : CVE-2026-18369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: go-fdo-server: go-fdo-server-1.0.1-0.5.hum1 aarch64, x8664 go-fdo-server-manufacturer-1.0.1-0.5.hum1 noarch go-fdo-server-owner-1.0.1-0.5.hum1 noarch go-fdo-server-rendezvous-1.0.1-0.5.hum1 noarc...

undici: undici: HTTP header injection via unvalidated blob-like body type property

A flaw was found in undici. An application that processes a hand-rolled blob-like request body with a type property derived from untrusted input may allow a remote attacker to inject Carriage Return Line Feed CRLF sequences. This vulnerability enables the attacker to append arbitrary HTTP headers...

Security Bulletin: consul-mcp-server vulnerable to server side request forgery leading to token exposure

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

Security Bulletin: A vulnerability has been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-10842)

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2026-0685

A flaw was found in the Genshi Template Engine. This server-side template injection SSTI vulnerability in the expression evaluation component allows a remote attacker to achieve remote code execution RCE. By sending crafted template expressions, an attacker can execute arbitrary code on the...

EUVD-2026-50562

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RC...

CVE-2026-63118

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

CVE-2026-46678

Pydantic AI CVE-2026-46678 affects versions 1.56.0–1.98.0 where force_download='allow-local' on a URL influenced by untrusted input can bypass the cloud-metadata blocklist using IPv6 transition forms (IPv4-mapped IPv6, 6to4, NAT64, NAT64/isatap variants). The issue is mitigated by upgrading to 1....