CVE-2026-110385

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...

Security Bulletin: IBM HTTP Server is affected by multiple vulnerabilities due to the included Apache HTTP Server and libexpat

Summary IBM HTTP Server used by IBM WebSphere Application Server is affected by multiple vulnerabilities due to libexpat and the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2026-66046 DESCRIPTION: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic...

PT-2026-113902

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS...

PT-2026-113878

Name of the Vulnerable Software and Affected Versions Juniper Junos OS on SRX Series devices affected versions not specified Description An XML Injection issue exists in the Unified Threat Management daemon utmd of Juniper Junos OS on SRX Series devices. An unauthenticated network attacker can...

CVE-2026-110385: External Control of File Name or Path

A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to execute arbitrary operating system commands as the ds service account. The Document Builder API improperly processes user-controlled...

CVE-2026-82715: Insecure Temporary File

Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A...

Linux Distros Unpatched Vulnerability : CVE-2026-107615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary...

PT-2026-114035

🚨 CVE-2026-110593 BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send email Celery task, which compiles the user-supplied AccountEmail message body with django.template.Template. Authenticated organization members can submit template tags through POST...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-102059: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the phone-home daemon phcd of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-110777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file,...

Security Updates for Microsoft SQL Server (October 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. CVE-2026-65674 - Heap-based buffer overflow...

AlmaLinux 9 : xorg-x11-server (ALSA-2026:82015)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:82015 advisory. xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests CVE-2026-93521 xorg-x11-server: xwayland:...

RockyLinux 9 : xorg-x11-server (RLSA-2026:82015)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82015 advisory. xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests CVE-2026-93521 xorg-x11-server: xwayland:...

Linux Distros Unpatched Vulnerability : CVE-2026-107613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the...

PT-2026-114013

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

Linux Distros Unpatched Vulnerability : CVE-2026-107612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-101895: Uncontrolled Resource Consumption

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server DOM emulation parser can enter an infinite synchronous loop when Angular server-side rendering...

Security Updates for Microsoft SharePoint Server Subscription Edition (October 2026)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Remote Code Execution via integer overflow in Microsoft Office SharePoint CVE-2026-88166 - Elevation of Privilege in SharePoi...