CVE-2026-64005

A flaw was found in the Linux kernel's Server Message Block SMC network component. This vulnerability occurs because the system's internal tables, known as hashtables, are improperly reset after they have already been initialized and are actively in use. This incorrect re-initialization can lead ...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the imageurl parameter in the chat completions endpoint. An attacker can access internal services and cloud metadata endpoints by supplying a crafted URL that redirects to internal addresses, as...

PT-2026-63558

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Applications using App Router, Server Actions use server, or use cache endpoints may disclose these endpoints, bypassing authentication on the pages...

PT-2026-63561

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption when that Server Action...

PT-2026-63563

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description A server-side fetch operation involving a request body may return a cached response body from a separate request directed to the same URL but containin...

PT-2026-63562

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description A server-side fetch operation involving a request body may return a cached response body from a different request sent to the same URL but with a...

PT-2026-63380

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.15.0 through 1.25.1 Description A use-after-free issue exists in the handling of DNS-over-TLS DoT forwarded queries. The TLS server name is tied to the lifetime of the serviced query struct but is also referenced ...

PT-2026-63460

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A user with read access can cause a Denial of Service DoS by executing a specifically crafted query. By using expressions that generate large arrays, the system...

PT-2026-63478

An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a...

PT-2026-63402

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation...

PT-2026-63466

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write privileges on a collection enabled with Queryable Encryption can modify internal encryption metadata fields that should be controlled by the server. This occu...

PT-2026-63544

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An issue exists in the OcspServerCertificateValidator where out-of-date OCSP Online Certificate Status Protocol responses are flagged but not stopped from...

PT-2026-63560

Name of the Vulnerable Software and Affected Versions Next.js versions 12.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Rules configured via rewrites or redirects that construct an external destination hostname using request-controlled input can be manipulated to point t...

PT-2026-63351

n8n versions before 1.123.64 contain a server-side request forgery vulnerability in the dynamic-node-parameters endpoints that lack authorization scopes. Authenticated attackers can supply absolute URLs in routing configuration to override baseURL restrictions and make the n8n server issue HTTP...

PT-2026-63354

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials Header Auth, Basic Auth, Query Auth, OAuth in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node...

PT-2026-63392

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.25.2 Description A heap buffer overflow occurs when the validator builds the canonical RDATA form for an RRSIG-covered PX, RP, MINFO, or SOA RRset. The system computes the address of the second embedded...

PT-2026-63416

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.11.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description A DNSSEC validating...

TencentOS Server 3: httpd:2.4 (TSSA-2026:0732)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0732 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:3156-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3156-1 advisory. The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues The following security issues were fixed: -...

Oracle MySQL Cluster 9.x < 9.7.2 (July 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are...