PT-2026-79041

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

libssh2: Multiple Vulnerabilities

Background libssh2 is a library implementing the SSH2 protocol. Description Multiple vulnerabilities have been discovered in libssh2. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

GNU Emacs: Arbitrary code execution

Background GNU Emacs is the extensible, customizable, self-documenting real-time display editor. Description A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details. Impact An attacker could achieve arbitrary code execution by tricking a use...

PT-2026-79044

Name of the Vulnerable Software and Affected Versions Apache InLong versions 2.0.0 through 2.3.x Description An SQL injection issue exists due to improper neutralization of special elements used in an SQL command. This occurs via unvalidated MyBatis $-sign interpolation within the...

CVE-2026-76572

pkp-lib (the shared library for Public Knowledge Project software) contains an XML External Entity (XXE) vulnerability in the _transformPHP function of classes/xslt/XSLTransformer.php. Affected versions are up to 3.3.0-22, 3.4.0-10, and 3.5.0-4. The vulnerability allows a remote attacker with hig...

CVE-2026-76227 Renovate 42.68.1 before 42.96.3 Environment Variable Exposure

Renovate versions from 42.68.1 before 42.96.3 and from 42.68.1 before 43.4.4, including corresponding Docker images renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker =13.3.0 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As ...

curl: curl: Insecure connection establishment due to TLS configuration mismatch

A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security TLS configuration of the new transfer does not match the existing connection,...

Exploit for CVE-2026-53959

CVE-2026-53959 - 4gaBoards python exploit.py http://localhost...

CentOS 9 : nghttp2-1.43.0-8.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the nghttp2-1.43.0-8.el9 build changelog. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

Oracle Linux 8 : nghttp2 (ELSA-2026-55804)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55804 advisory. 1.33.0-6.3 - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

MiracleLinux 8 : nghttp2-1.33.0-6.el8_10.3 (AXSA:2026-1576:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1576:03 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted t...

CVE-2026-21584

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead...

CVE-2026-21582

Crowd Data Center 7.2.1 has a Broken Authentication & Session Management flaw (CVSS 8.8) letting unauthenticated attackers act as other users; Atlassian advises upgrading to 7.2.2 or later . No exploitation details are provided in the documents.

EUVD-2026-36431

jmespath.php has CompilerRuntime code injection via unescaped function names...

CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...

CVE-2026-20345 affecting package clamav for versions less than 1.5.4-1

CVE-2026-20345 affecting package clamav for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-20338 affecting package clamav for versions less than 1.5.4-1

CVE-2026-20338 affecting package clamav for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-75773

The vulnerability is in the authorize function of apps/web/server/auth.ts in karakeep up to 0.32.0, allowing unlimited login attempts on the remote Login Endpoint. It is rated CVSS 3.7 (LOW) with high attack complexity. Upgrading to 0.33.0 (patch f7d042971d0d2bcc7119654830cf1eb93eabbf24) resolves...

CVE-2026-75773 karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the file apps/web/server/auth.ts of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed...

CVE-2024-14045

OpenBoxes up to 0.9.2 is affected by an improper authorization vulnerability in the Product Supplier Edit Controller , specifically in the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy. A remote attacker with low privileges can exploit this flaw to bypass authorization cont...