SaltStack <=3002 - Shell Injection

SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client. id: CVE-2020-16846 info: name: SaltStack =3003 to mitigate this vulnerability. reference: -...

XWiki Platform - Remote Code Execution

Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1. id: CVE-2025-24893 info: name: XWiki...

PT-2026-89459

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.26 through 2.11.56 Traefik versions 3.4.2 through 3.7.12 Description Traefik contains a request smuggling issue related to the handling of the HTTP/1.1 Upgrade mechanism. The software forwards client-supplied Connection...

PT-2026-89311

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

CVE-2026-88270: Missing Authorization

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

PT-2026-89702

Summary There is a high-severity request-smuggling vulnerability in Traefik's handling of the HTTP/1.1 Upgrade mechanism. Since Traefik moved to unencrypted HTTP/2 with prior knowledge Go 1.24, a client-initiated Upgrade: h2c request header and its connection-specific HTTP2-Settings header were...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch6 Vulnerability Details CVEID:CVE-2026-59870 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts use...

SUSE-SU-2026:4113-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate bsc1273125. - CVE-2026-69243: HTTP request smuggling via the WebSocket upgrade procedure bsc1273553...

List of Security Fixes and Improvements in Veeam Plug-in for KubeVirt

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for KubeVirt. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security...

List of Security Fixes and Improvements in Veeam Plug-in for Xen

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for Xen. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security Fixes a...

List of Security Fixes and Improvements in Veeam Plug-in for Proxmox VE

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for Proxmox VE. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security...

List of Security Fixes and Improvements in Veeam Plug-in for Scale Computing HyperCore

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for Scale Computing HyperCore. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between...

List of Security Fixes and Improvements in Veeam Plug-in for oVirt KVM

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for oVirt KVM. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security...

List of Security Fixes and Improvements in Veeam Plug-in for HPE Morpheus VM Essentials

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Plug-in for HPE Morpheus VM Essentials. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between...

List of Security Fixes and Improvements in Veeam Backup for Salesforce

Purpose This article describes all security-related fixes and improvements introduced in each release or update of Veeam Backup for Salesforce. This article aims to provide our customers' security and compliance teams with detailed information on security improvements between releases. Security...

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3286)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

PT-2026-87061

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...

CVE-2026-86437 Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...