CVE-2026-64785: Inconsistent Interpretation of HTTP Requests

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...

PT-2026-63866

Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...

PT-2026-63827

Unauthenticated Cross Site Scripting XSS in Download Monitor - WPForms Lock = 1.0.4 versions...

RockyLinux 8 : .NET 8.0 (RLSA-2026:41901)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41901 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

PT-2026-64146

Name of the Vulnerable Software and Affected Versions aws-smithy-http-server versions prior to 0.66.5 Description An issue in the default serve path of Amazon aws-smithy-http-server allows unauthenticated Slowloris denial of service. This occurs due to missing connection and header-read timeouts...

PT-2026-63833

Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...

PT-2026-63940

Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...

CVE-2026-65754: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

PT-2026-63929

Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...

PT-2026-63805

Contributor SQL Injection in eRoom = 1.7.1 versions...

CVE-2026-65537: Missing Authorization

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

PT-2026-63840

Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...

jaeger-lab-to-nwb (0.1.1), xircuits (1.3.0) potentially affected by CVE-2026-73626 via jupyterlab (3.3.2)

jupyterlab PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jaeger-lab-to-nwb 0.1.1 - xircuits 1.3.0 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

CVE-2026-56434 affecting package nginx for versions less than 1.28.3-8

CVE-2026-56434 affecting package nginx for versions less than 1.28.3-8. A patched version of the package is available...

Security Bulletin: IBM Cognos Command Center has addressed vulnerabilities

Summary There are vulnerabilities in IBM Cognos Command Center. IBM Cognos Command Center 10.2.5 FP1 IF4 has addressed the applicable CVEs. Please refer to the table in the Related Information section for vulnerability impact. Vulnerability Details CVEID:CVE-2026-34197 DESCRIPTION: Improper Input...

WordPress Tickera – Sell Tickets & Manage Events plugin <= 3.6.0.1 - Authenticated (Staff+) SQL Injection vulnerability

Authenticated Staff+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Tickera versions = 3.6.0.1...

parsec-cloud v3.9.3-rc.0

.. raw:: html root@kitploit: Simple, secure, end-to-end encrypted file sharing in the cloud Parsec Parsec is a cloud-based application for simple and cryptographically secure file sharing. 🔐 Client-side E2EE to ensure your data is only accessed by you and the people you share it with. ✒️...

CVE-2026-3482 IBM Sterling B2B Integrator and IBM Sterling File Gateway Authorization Bypass

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request...

CVE-2026-64833

FFmpeg versions 0.7.1 through 8.1.2 contain an out-of-bounds read vulnerability in the S/PDIF muxer that allows attackers to access memory beyond buffer boundaries by supplying a crafted DTS stream with a coresize value larger than the actual packet length. Attackers can exploit the missing bound...

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...