CVE-2026-114721

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabledactions by requesting it through its deprecated...

Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shell

Deep-Technical-Report-CVE-2026-109618-CVE-2026-109619-PHP2Shel...

CLEANSTART-2026-NR53059 In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Security vulnerability affects the kafka package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4799-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4799-1 advisory. - CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash bsc1281912. -...

Heasarc CFITSIO buffer error vulnerability

Heasarc CFITSIO versions 4.7.0 and earlier contain a buffer error vulnerability. This vulnerability arises because the ffgcls2 function in getcols.c trusts heap descriptor length processing for handling variable-length string columns controlled by attackers; this leads to an out-of-bounds write. ...

PT-2026-120953

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled actions by requesting it through its deprecate...

PT-2026-134734

Security vulnerability affects the kafka package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

Roundcube Webmail Project Roundcube Webmail authorization issue vulnerability

The Roundcube Webmail project contains an authorization issue vulnerability in versions prior to 1.6.20 and 1.7.5 of version 1.7.x. This vulnerability arises because the check only compares the action name of a request without parsing any deprecated aliases. Remote authenticated attackers can...

PT-2026-120945

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

Memory corruption vulnerabilities in PHP

Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve...

SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:4797-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4797-1 advisory. - CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion...

PT-2026-121578

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

Bytecode Alliance wasmtime improper exception handling vulnerability

The Bytecode Alliance Wasmtime versions prior to 46.0.0 and 48.0.4, as well as versions prior to 49.0.0 and 49.0.2, contain a vulnerability related to improper exception handling. This vulnerability stems from the implementation of Wasmtime-Wasi’s WASIp3 component; a guest with variable pre-open...

PT-2026-121505

Name of the Vulnerable Software and Affected Versions LiteLLM versions 1.87.0 through 1.100.3 LiteLLM versions 1.101.0 through 1.101.2 LiteLLM versions 1.102.0 through 1.102.1 LiteLLM versions 1.103.0 LiteLLM versions 1.104.0-rc.0 through 1.104.0-rc.1 Description LiteLLM reuses a single...

PT-2026-120969

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube user::query matched the address against identity records without qualifying the lookup by IMAP host, so a...

RHEL 8 : sudo (RHSA-2026:87026)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:87026 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

PT-2026-121321

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable...

Oracle Linux 8 : php:7.4 (ELSA-2026-87080)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87080 advisory. - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619 - Fix IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792612974)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792612974 advisory. - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142542)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142542 advisory. In the Linux kernel, the following vulnerability has been resolved: rapidio/tsi721: prevent a bad dereference in tsi721dbdpc With a listforeach loop, if we don't fin...