PT-2026-54800

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the slimbus qcom-ngd-ctrl component where callbacks may operate on uninitialized data. This occurs when the remoteproc starts in parallel with the NGD driver being...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.3)

The version of AHV installed on the remote host is prior to 11.0.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.3 advisory. - A flaw was found in GLib Gnome Lib. This vulnerability allows a remote attacker to cause heap corruption, leading to a...

PT-2026-54750

Name of the Vulnerable Software and Affected Versions Guardian language-system affected versions not specified Description An unauthenticated remote attacker can execute arbitrary OS commands on the server. The issue occurs because the translate text.php file passes the id GET parameter directly...

PT-2026-55153

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback Summary auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6 loopback addresses in their...

PT-2026-54930

Name of the Vulnerable Software and Affected Versions FatFs versions R0.16 and earlier Description An issue exists in the handling of long filenames when LFN Long File Name is enabled. The fno.fname variable can contain up to 255 characters, which may lead to a buffer overflow if callers copy thi...

Alibaba Cloud Linux 3 : 0163: libpng15 (ALINUX3-SA-2026:0163)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0163 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for u...

PT-2026-54735

Name of the Vulnerable Software and Affected Versions Guardian language-system affected versions not specified Description An unauthenticated attacker can perform error-based SQL injection by sending crafted values to the id parameter via a GET request to the 'job info.php' endpoint. The issue...

PT-2026-55114

Vulnerability Metadata | Field | Detail | | --- | --- | | Affected Component | src/core/git/gitCommand.ts execGitShallowClone | | Impact | Arbitrary Command Execution / Security Control Bypass | Summary The --remote-branch CLI option in repomix is vulnerable to argument injection. User-supplied...

SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:2238-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2238-1 advisory. The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issu...

PT-2026-55219

Name of the Vulnerable Software and Affected Versions @apify/actors-mcp-server versions prior to 0.10.11 Description An authority injection issue exists where the software constructs Actor standby URLs by concatenating a trusted base URL with an attacker-controlled webServerMcpPath variable witho...

PT-2026-55214

Name of the Vulnerable Software and Affected Versions neuro-cortex-memory versions 3.17.0 and later Description Local arbitrary code execution is possible because the server treats the CLAUDE PROJECT DIR environment variable as a trusted source root. When the open visualization tool is invoked, t...

Alibaba Cloud Linux 3 : 0168: libpng12 (ALINUX3-SA-2026:0168)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0168 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for u...

Alibaba Cloud Linux 3 : 0174: libpng (ALINUX3-SA-2026:0174)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0174 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-33416: LIBPNG is a reference library for u...

Alibaba Cloud Linux 3 : 0166: xorg-x11-server (ALINUX3-SA-2026:0166)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0166 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-50256: A stack-based buffer...

Rocky Linux security update in Brocade ASCG 3.4.0c (CVE-2025-68724, CVE-2026-23401, CVE-2026-31402, CVE-2025-40252)

CVE-2025-68724- Title: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Description In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - prevent overflow in asymmetrickeygenerateid Use checkaddoverflow to guard against potential integer...

PT-2026-55205

Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 3.1.1 Description The @sigstore/verify library incorrectly derives a transparency-log timestamp from the tlogEntries.integratedTime variable for bundle v0.2 inclusionProof-only entries. Because the inclusion proof...

GeoVision GeoWebPlayer Websocket Server connectInfo handler stack-based buffer overflow vulnerabilities

Summary Multiple exploitable stack-based buffer overflow vulnerabilities exist in the Websocket Server connectInfo handler functionality of GeoWebPlayer versions: 1.1.1.0. A specially crafted websocket message can lead to a arbitrary code execution. An attacker can stage a malicious webpage to...

PT-2026-54818

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL dereference occurs in the ASOC wm adsp component during the removal of firmware controls. The function wm adsp control remove attempts to clean up private data pointed to by the...

Cross-site Scripting (XSS)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ChatTrigger template rendering in ChatTrigger/templates.ts. An authenticated user who can create or edit workflows can inject malicious JavaScript by supplying crafted Custo...

CVE-2026-56278

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...