Aquatronica Controller System <= 5.1.6 - Information Disclosure

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

Astra Linux - Vulnerability in libjdom1-java, libjdom2-java

A XXE vulnerability exists in SAXBuilder in JDOM through version 2.0.6, allowing attackers to cause a denial of service through a crafted HTTP request...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: EFI: Runtime: Avoid EFIv2 runtime services on Apple x86 machines Aditya reports that his recent MacBookPro crashes during firmware updates when variable services are used at runtime. The culprit seems to be a call to...

EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-3153)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : User-controlled header names and values containing newlines can allow injecting HTTP headers.CVE-2026-0865 Tenable has extracted the preceding...

CVE-2026-47664

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

CVE-2026-47664 Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, the $import-pnp operation in Pathling Server accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without...

Security Bulletin: Authenticated denial of service in Consul Enterprise-to-Community Edition downgrade path

Summary Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can...

CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-48098

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using sudo and shell=True directly inside application logic. In environments where passwordless sudo NOPASSWD is enabled,...

CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

EulerOS 2.0 SP15 : libXpm (EulerOS-SA-2026-2892)

According to the versions of the libXpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in X.org libXpm up to 3.5.4. It has been classified as problematic.CWE is classifying the issue as CWE-125. The product...

EulerOS 2.0 SP13 : shim (EulerOS-SA-2026-3050)

According to the versions of the shim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required C...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a denial of service (CVE-2026-16192)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a denial of service vulnerability with the restConnector-1.0 or restConnector-2.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

CLSA-2026-1782954034 TuxCare security update for set-value (2 CVEs)

TuxCare rebuilt set-value to address 2 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1777250300 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 2.0.4-tuxcare.4...

EUVD-2026-52031

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS BC-FJA before bcpg-fips 2.0.13...

CVE-2026-15964

The WordPress plugin Single Sign On For TNG (WordPress) is affected up to version 2.0.0 by an authentication bypass via unauthenticated password reset. The root cause is the ssoprocess_ajax() handler (wp_ajax_nopriv_ssoprocess_ajax) accepting an attacker-supplied email with setnewpassword and cal...

CLEANSTART-2026-RX52508 Security fixes in consul 2.0.0-r0

Package consul version 2.0.0-r0 fixes 21 vulnerabilities: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831...

GHSA-6WCC-39RP-HH9P @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

A SQL injection vulnerability exists in the escapeValue function used for parameter substitution. escapeValue dispatches on the type of the parameter value, and two of its branches failed to escape safely. An attacker who can control a parameter value can terminate the enclosing string literal an...

CVE-2026-16192 IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled...