PT-2026-105816

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

PT-2026-103697

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...

CVE-2026-103286: Incorrect Privilege Assignment

Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege staff users to escalate to higher-privilege staff roles. Attackers with low-privilege staff access can exploit the notifications system to gain elevated...

PT-2026-103951

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR841N affected versions not specified Description An authenticated OS command injection exists in the IPv6 WAN configuration. This occurs when a crafted value provided to the IPv6 Gateway is improperly incorporated into a system...

CVE-2026-103884: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...

PT-2026-103953

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to...

Jev-IDS: System One Models for Network Intrusion Detection

Machine-learning Network Intrusion Detection Systems IDS depend on substantial labeled datasets and task-specific training, whereas Large Language Models LLMs detection can analyze flow records directly but incurs higher inference cost and latency, with less constrained outputs. This paper presen...

CVE-2026-12545: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...

PT-2026-103914

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

PT-2026-103958

Name of the Vulnerable Software and Affected Versions rubygem-hammer cli affected versions not specified Description Command injection is possible in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite. The issue occurs because the $EDITOR environment variable is...

CVE-2026-66248: Generation of Error Message Containing Sensitive Information

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

PT-2026-103818

Name of the Vulnerable Software and Affected Versions Ghost versions 2.21.0 through 6.55.0 Description A privilege escalation issue exists in the notifications system. This flaw allows users with low-privilege staff access to elevate their roles to higher-privilege staff levels due to a lack of...

PT-2026-103918

Name of the Vulnerable Software and Affected Versions Foreman affected versions not specified Description OS command injection flaws exist in the foreman-rake db:dump and db:import dump tasks. The application does not properly sanitize user-supplied input in the destination parameter during backu...

CVE-2026-12541: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...

Rocky Linux 9.6 [TuxCare] Security Update: jq / jq-devel (ALMALINUX9.6:CLSA-2026:1782983956)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782983956 advisory. - jq is a command-line JSON processor. Prior to 1.8.2, on 32bit system, jvpstringappend has a chance of integer/multiple overflowing and th...

Rocky Linux 8 [CIQ] Security Update: spamassassin / spamassassin-debuginfo / spamassassin-debugsource (crlsa-2021_4315)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214315 advisory. spamassassin: Malicious rule configuration files can be configured to run system commands CVE-2020-1946 Tenable has extracted the preceding description block direct...

AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1790844951)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790844951 advisory. - In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers,...

CentOS Linux 6 [TuxCare] Security Update: libwebp / libwebp-devel / libwebp-java / libwebp-tools (CENTOS6:CLSA-2025:1758645375)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1758645375 advisory. - A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid...

CentOS Linux 8.4 [TuxCare] Security Update: systemd / systemd-container / systemd-devel / etc (CENTOS8.4:CLSA-2026:1784813597)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784813597 advisory. - systemd, a system and service manager, as PID 1 hits an assert and freezes execution when an unprivileged IPC API call is made with spuriou...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1754650455)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1754650455 advisory. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through...