Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

PT-2026-63482

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...

PT-2026-63481

A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element,...

PT-2026-63545

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description The OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous Online Certificate Status Protocol OCSP validation...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

PT-2026-63412

Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.11.3-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description BIND may accept incorrec...

PT-2026-63475

An authenticated user with read access can cause the mongod process to be terminated through certain aggregation expressions that execute server-side JavaScript. The issue involves improper memory handling during document processing...

PT-2026-63386

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions 1.18.0 through 1.25.1 Description When the software listens on a 'proxy-protocol-port' interface with answer-cookie: yes, the RFC 9018 server-cookie SipHash is computed using the proxy's wire address rather than the...

PT-2026-63403

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests...

PT-2026-63564

Name of the Vulnerable Software and Affected Versions Next.js versions 14.1.1 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host, leading to...

PT-2026-63556

Name of the Vulnerable Software and Affected Versions Next.js versions 13.0.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description Crafted requests targeting applications using App Router with at least one Server Action can cause excessive CPU usage, which blocks the processing of...

The vulnerability of the webService() method in the Calculation/Web/Service.php PHP library allows a attacker to perform an SSRF attack.

The vulnerability of the webService method in the Calculation/Web/Service.php PHP library of the PhpSpreadsheet framework is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

PT-2026-63470

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description Improper handling of DBPointer objects during BSON serialization the process of converting data into a binary format in the server-side JavaScript engine can lead to internal process memory...

Oracle MySQL Server 9.x < 9.7.2 (July 2026 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are...

Oracle MySQL Cluster 8.4.x < 8.4.11 (July 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the grid image processing and uninitialized pixel plane allocation. An attacker can access sensitive heap memory contents by uploading a specially crafted AVIF or HEIC file to a server-side image processor,...

SUSE CVE-2026-58624

Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...

CVE-2026-65318

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65315

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...