PT-2026-50501

Name of the Vulnerable Software and Affected Versions Splunk AI Toolkit versions prior to 5.7.4 Description A low-privileged user without "admin" or "power" Splunk roles can force the application to make outbound HTTP requests to an attacker-controlled server, potentially leading to data...

NPM: n8n: Microsoft SQL Node Prototype Pollution

NPM: n8n: Microsoft SQL Node Prototype Pollution vulnerability discovered by ? in WordPress Npm n8n versions 2.24.0...

NPM: n8n: NoSQL Injection in MongoDB Node Find And Replace Operation

NPM: n8n: NoSQL Injection in MongoDB Node Find And Replace Operation vulnerability discovered by ? in WordPress Npm n8n versions 2.24.0...

Mozilla Firefox < 152.0

The version of Firefox installed on the remote Windows host is prior to 152.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-57 advisory. - Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

CVE-2026-39527

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

CVE-2026-40767 WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in wpForo Forum 3.0.2 versions...

CVE-2026-39828 affecting package telegraf for versions less than 1.31.0-23

CVE-2026-39828 affecting package telegraf for versions less than 1.31.0-23. A patched version of the package is available...

CVE-2026-42502 affecting package telegraf for versions less than 1.31.0-23

CVE-2026-42502 affecting package telegraf for versions less than 1.31.0-23. A patched version of the package is available...

CVE-2026-5223 affecting package rust for versions less than 1.90.0-9

CVE-2026-5223 affecting package rust for versions less than 1.90.0-9. A patched version of the package is available...

CVE-2026-42535 affecting package httpd for versions less than 2.4.68-1

CVE-2026-42535 affecting package httpd for versions less than 2.4.68-1. A patched version of the package is available...

CVE-2026-42504 affecting package golang for versions less than 1.25.11-1

CVE-2026-42504 affecting package golang for versions less than 1.25.11-1. A patched version of the package is available...

Linux Distros Unpatched Vulnerability : CVE-2026-7765

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in the User Messages dashboard widget in Checkmk 2.5.0p5 causes the message- fetching endpoints to return the dashboard creator's messag...

Veeam Backup and Replication < 12.3.2.4854 (kb4869)

The version of Veeam Backup and Replication installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4869 advisory. - A vulnerability allowing remote code execution RCE on the Backup Server by an authenticated domain user...

CVE-2026-7186 Fix stored XSS in URL dashboard widget via dangerous URI schemes

Stored cross-site scripting in the URL dashboard widget in Checkmk 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 versions allows a user with dashboard editing permissions to store a URL with a dangerous URI scheme such as javascript: that executes scripts in other users' browsers when they view the...

CVE-2026-4893 affecting package dnsmasq for versions less than 2.92-1

CVE-2026-4893 affecting package dnsmasq for versions less than 2.92-1. A patched version of the package is available...

CVE-2024-22018 affecting package nodejs for versions less than 24.14.1-3

CVE-2024-22018 affecting package nodejs for versions less than 24.14.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2026-43968 affecting package rabbitmq-server for versions less than 3.13.7-5

CVE-2026-43968 affecting package rabbitmq-server for versions less than 3.13.7-5. A patched version of the package is available...

EUVD-2026-34164

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the Workflow, Form block, and File/Set components that lack the allowedclasses restriction. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been...

CVE-2026-42502 affecting package kubernetes for versions less than 1.30.10-25

CVE-2026-42502 affecting package kubernetes for versions less than 1.30.10-25. A patched version of the package is available...

CVE-2026-40547

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 Missing...