CVE-2026-106931: Improper Neutralization of Special Elements used in an OS Command

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

PT-2026-114152

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description The shadow server dispatches input Protocol Data Units PDUs during the Confirm Active state before authentication is completed. This allows unauthenticated attackers to inject synthetic keyboar...

CVE-2026-110717: Improper Limitation of a Pathname to a Restricted Directory

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

VulnCheck KEV: CVE-2026-106931

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-102893: Improper Authentication

Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity provider email claim to an active account's deliveryemail without rejecting an explicitly false emailverified claim. If a configured identity provider returns a...

CVE-2026-110829: NULL Pointer Dereference

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

CVE-2026-110690: Relative Path Traversal

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

CVE-2026-110447: Improper Neutralization of Special Elements used in an OS Command

Collabora Online Built-in CODE Server before 26.4.303 richdocumentscode, a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't...

PT-2026-113597

Name of the Vulnerable Software and Affected Versions Hitachi Disk Array Driver for AIX versions 01-00 through 01-22-/A Hitachi Disk Array Driver for Virtual I/O Server versions 01-04 through 01-22-/A Description An insecure temporary file issue exists in the Hitachi Disk Array Driver for AIX and...

PT-2026-113598

Name of the Vulnerable Software and Affected Versions Hitachi Disk Array Driver for AIX versions 01-00 through 01-22-/A Hitachi Disk Array Driver for Virtual I/O Server versions 01-04 through 01-22-/A Description An out-of-bounds write issue exists in the Hitachi Disk Array Driver for AIX and the...

Microsoft Exchange Server Buffer Overflow RCE

The vulnerability of Microsoft Exchange Server’s mail server is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-114168

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.97 Parse Server versions 9.0.0 through 9.10.2-alpha.5 Description Improper error handling occurs when sending verification or password reset emails, which can lead to the server process exiting. An attacker...

CVE-2026-110854: Uncaught Exception

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password rese...

Security Updates for Microsoft SQL Server (October 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. CVE-2026-65674 - Heap-based buffer overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-110777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file,...

Linux Distros Unpatched Vulnerability : CVE-2026-110225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-server (UTSA-2026-130063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130063 advisory. RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service DoS...

SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2026:4636-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4636-1 advisory. - CVE-2026-88812: XKB SetGeometry TextDoodad Double Free bsc1281213. - CVE-2026-93515: X.Org Server Present Extension Use-After-Fre...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rabbitmq-server (UTSA-2026-130060)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130060 advisory. RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations...

Security Updates for Microsoft Exchange Server (October 2026)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to...