ElasticSearch <1.6.1 - Local File Inclusion

ElasticSearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. id: CVE-2015-5531 info: name: ElasticSearch 1.6.1 - Local File Inclusion author: princechaddha severity: medium description: ElasticSearch before 1.6.1 allows remote...

Joomla! Webservice - Password Disclosure

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. id: CVE-2023-23752 info: name: Joomla! Webservice - Password Disclosure author: badboycxcc,Sascha Brendel severity: medium description: | An issue was discovered in...

Zoho ManageEngine OpManger - Arbitrary File Read

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a specially crafted request. id: CVE-2020-12116 info: name: Zoho ManageEngine OpManger - Arbitrary File Read author:...

PT-2026-102965

Name of the Vulnerable Software and Affected Versions AiSOC versions 7.5.0 through 11.x Description The realtime WebSocket and SSE service uses a hard-coded constant for JSON Web Token JWT verification when the AISOC REALTIME JWT SECRET environment variable is not configured. This allows...

PT-2026-103581

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description Kiteworks Email Protection Gateway failed to sufficiently restrict the assignment of certificates to accounts. This flaw allows an attacker to associate a certifica...

PT-2026-103632

Name of the Vulnerable Software and Affected Versions decolua 9Router versions prior to 0.5.56 Description A server-side request forgery SSRF issue exists in the Search Endpoint component. This occurs when the fetch function within the src/shared/utils/ssrfGuard.js file does not properly handle t...

PT-2026-102967

Name of the Vulnerable Software and Affected Versions AiSOC versions 5.1.0 through 11.9.9 Description An authentication bypass exists in the realtime service internal endpoints 'POST /internal/agent-event' and 'POST /internal/push'. This allows attackers to submit arbitrary events using spoofed...

CentOS Linux 8.4 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc (CENTOS8.4:CLSA-2026:1777942551)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777942551 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP...

Important: pki-core security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content ExternalProcessConstraint CVE-2026-76561 pki-core: Dogtag PKI v2 REST ACL...

CentOS Linux 8.5 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1768587465)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1768587465 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

Rocky Linux 9.6 [TuxCare] Security Update: java-21-openjdk / java-21-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778051357)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778051357 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

AlmaLinux 9.2 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1741637440)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741637440 advisory. - When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first...

Rocky Linux 9.6 [TuxCare] Security Update: gnutls / gnutls-c++ / gnutls-dane / gnutls-devel / gnutls-utils (ALMALINUX9.6:CLSA-2026:1779827686)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779827686 advisory. - A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels,...

RHEL 9 : pki-core (RHSA-2026:73766)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73766 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core:...

Rocky Linux 9.6 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787786503)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787786503 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790266264)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790266264 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

PT-2026-103178

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

PT-2026-104823

It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access...

CVE-2026-102588: Origin Validation Error

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-102139: Authorization Bypass Through User-Controlled Key

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of...