PT-2026-103936

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description A NULL pointer dereference occurs in the mod xml2enc module. This allows an untrusted backend server to trigger a denial of service by sending a proxied response with a charset that...

PT-2026-105092

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead denial of service via Excessive Allocation CAPEC-130...

CVE-2026-48005: Missing Authentication for Critical Function

Missing authentication checks in modauthdigest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service forced re-authentication via forged Authorization headers when Digest authentication is enabled with...

PT-2026-103897

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

PT-2026-105173

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

CVE-2026-67105: Cleartext Transmission of Sensitive Information

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...

PT-2026-105100

Uncontrolled Resource Consumption CWE-400 in Kibana can lead denial of service via Excessive Allocation CAPEC-130...

PT-2026-104006

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket Application Programming Interface lacks rate limiting on authentication requests. This deficiency allows an attacker to perform brute-force attacks to obtain unauthorized acce...

PT-2026-103967

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-67172: Exposure of Sensitive Information to an Unauthorized Actor

HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...

CVE-2026-56599: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

CVE-2026-79901: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

In deployments using BoKS keytab management, affected versions of bokskeytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change tim...

PT-2026-103938

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks...

CVE-2026-103268: Missing Authorization

Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to regain active account access and...

PT-2026-105924

Impact Denial of service via memory exhaustion. Affects all callers who streamed compressed responses relying on the chunk size — explicit iter byteschunk size=... or the default — to bound memory. The decoder ignored that bound, so a chunk could be far larger than requested and a single compress...

PT-2026-103660

BlueALSA bluez-alsa/bluealsad contains a division-by-zero vulnerability in the LC3plus sink decoder a2dp-lc3plus.c, a2dp lc3plus dec thread that allows a Bluetooth-adjacent attacker to crash the daemon by sending a crafted RTP media header with an attacker-controlled frame count field set to zero...

Apple iCloud Mail Arbitrary Email Sender Spoofing

Apple iCloud Mail contained two SMTP submission-service parsing issues that allowed authenticated users to send email as arbitrary icloud.com addresses while passing SPF, DKIM, and DMARC checks...

PT-2026-105091

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130...

PT-2026-105795

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling import module path, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before an...

PT-2026-103935

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description A stack-based buffer overflow exists in the mod vhost alias module. A remote client can trigger a denial of service or potentially execute arbitrary code by sending an HTTP request with a...