Linux Distros Unpatched Vulnerability : CVE-2026-18688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's aggregation framework could allow an authenticated user to trigger an out-of- bounds memory read by providing a specially formed...

Oracle WebLogic Server Remote Takeover (August 2026 CPU) (12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0)

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by a vulnerability as referenced in the August 2026 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS Core Components...

Linux Distros Unpatched Vulnerability : CVE-2026-18691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used...

RHEL 10 / 8 / 9 : java-21-openjdk (RHSA-2026:55787)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55787 advisory. The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-18692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to b...

Linux Distros Unpatched Vulnerability : CVE-2026-18687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypte...

ALSA-2026:55775 Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Enhance TLS server CVE-2026-70907 For more details about...

Moderate: java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixes: JDK: Improve Resource Resolving CVE-2026-60589 JDK: Enhance HTTP Connections CVE-2026-61308 JDK: Improve font loading CVE-2026-70906 JDK: Enhance TLS server...

PT-2026-78557

Name of the Vulnerable Software and Affected Versions marimo versions prior to 0.23.15 Description A code injection flaw exists in the notebook configuration handler. Attackers can execute arbitrary commands by embedding a crafted MCP server entry with a controlled command value within a notebook...

PT-2026-78590

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Improper certificate validation allows a remote attacker to impersonate the TNC policy server and modify network traffic. Recommendations At the moment, there is no...

PT-2026-78407

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists in the OpenCypher LOAD CSV implementation that fails to validate HTTP/HTTPS URLs. Authenticated attackers can craft LOAD CSV queries pointing to internal network addresses or cloud...

PT-2026-78376

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An unauthenticated attacker with remote access can exploit a Server-Side Request Forgery SSRF issue, which is a flaw that allows a requester to induce the server to make requests t...

PT-2026-78641

Name of the Vulnerable Software and Affected Versions Ozols Grupa OZOLS versions prior to 1.1.1233 Description The software contains a flaw in its automatic update channel, specifically affecting the OzolsSQL client update path, the serv update.vbs file, and the update SQL Server Agent job using...

CVE-2026-75149: Improper Control of Generation of Code

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a notebook. When the notebook is opened in edit mod...

CVE-2026-68899: Unrestricted Upload of File with Dangerous Type

Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid in models/fileValidation.js used the Unix file command for content-based MIME detection, but detectMimeFromFile silently returned undefined when that binary was unavailable and the validation fell back to the...

CVE-2026-68559: Authorization Bypass Through User-Controlled Key

Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...

CVE-2026-17565: Server-Side Request Forgery (SSRF)

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back...

CVE-2026-76404: Deserialization of Untrusted Data

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored da...

CVE-2026-76316: Improper Neutralization of Special Elements in Data Query Logic

In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...

PT-2026-78743

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user with access to the management port...