PT-2026-113902

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS...

PT-2026-113899

Name of the Vulnerable Software and Affected Versions Junos OS versions prior to 23.2R2-S7.7 Junos OS versions prior to 23.4R2-S8.13 Junos OS versions prior to 24.2R2-S5.5 Junos OS versions prior to 24.4R2-S5 Junos OS versions prior to 25.2R2-S2 Junos OS versions prior to 25.4R1-S3 Junos OS...

PT-2026-114013

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

PT-2026-113878

Name of the Vulnerable Software and Affected Versions Juniper Junos OS on SRX Series devices affected versions not specified Description An XML Injection issue exists in the Unified Threat Management daemon utmd of Juniper Junos OS on SRX Series devices. An unauthenticated network attacker can...

CVE-2026-110777: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

Linux Distros Unpatched Vulnerability : CVE-2026-107613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the...

Linux Distros Unpatched Vulnerability : CVE-2026-107615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-107614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer underflow in WinCursorShapeUtils::trimTransparent in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash th...

Linux Distros Unpatched Vulnerability : CVE-2026-107612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-102059: Improper Neutralization of Special Elements used in an OS Command

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the phone-home daemon phcd of Juniper Networks Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series allows an adjacent unauthenticated attacker to execute arbitrary...

CVE-2026-110838: Missing Authentication for Critical Function

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

VulnCheck KEV: CVE-2026-106931

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

PT-2026-114182

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0 Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP clie...

PT-2026-114035

🚨 CVE-2026-110593 BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send email Celery task, which compiles the user-supplied AccountEmail message body with django.template.Template. Authenticated organization members can submit template tags through POST...

PT-2026-113752

Name of the Vulnerable Software and Affected Versions PCMan FTP Server versions prior to 2.0.8 Description A buffer overflow occurs in the PORT Command Handler component. This issue allows a remote attacker to cause a crash or potentially execute arbitrary code by manipulating an unknown function...

PT-2026-114020

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...

PT-2026-114168

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.97 Parse Server versions 9.0.0 through 9.10.2-alpha.5 Description Improper error handling occurs when sending verification or password reset emails, which can lead to the server process exiting. An attacker...

PT-2026-114119

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending ...