PT-2026-65034

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http proxy v2 module and ngx http grpc module modules. This vulnerability exists when the proxy http version to 2 or grpc pass directives are used to proxy HTTP/2 traffic, the ignore invalid headers directive is set to off, and the...

PT-2026-65241

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description An access issue exists where an application may be able to break out of its sandbox. A sandbox is a security mechanism...

CVE-2026-51564

An issue in the redirect parameter in Milk admin =0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request...

PT-2026-65296

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 Description An out-of-bounds write issue exists due ...

PT-2026-65194

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description An out-of-bounds write issue exists where an application can write data past the end of a defined memory buffer. This c...

PT-2026-65311

Name of the Vulnerable Software and Affected Versions Milk admin versions 0.9.8 and earlier Description An issue exists where remote attackers can redirect users to arbitrary external URLs by sending a crafted request. This is caused by improper handling of the redirect parameter. Recommendations...

PT-2026-65326

Name of the Vulnerable Software and Affected Versions Anti Spam and list cleaner – AcyChecker versions prior to 1.8.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations...

EUVD-2026-49420

schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader. Multiple attacker-controlled index parameters are used to access static and heap table arrays without range limitation. Invalid index values lead to out-of-bounds memory writing and heap buffer overflow...

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

PT-2026-65042

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

PT-2026-64877

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Python bindings. This issue occurs during unbounded Zlib decompression within the...

PT-2026-64883

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Ruby bindings. This issue occurs during ZLIB decompression within the THeaderTransport...

Fedora 43 : skopeo (2026-4d9a2870e5)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d9a2870e5 advisory. Security fix for CVE-2026-27145 Go stdlib crypto/x509 DoS vulnerability. Rebuild with golang-1.25.12 which includes the fix. Tenable has extracted the...

PT-2026-64878

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An infinite loop issue exists in the Python, Go, PHP, and Java bindings of Apache Thrift. This occurs due to a loop with an unreachable exit condition within the TCompactProtocol varint...

PT-2026-64880

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper validation of certificates with host mismatch occurs in the Apache Thrift c glib bindings. This issue results in the TLS client failing to perform necessary hostname verification...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

PT-2026-65091

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Ticket...

PT-2026-64890

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An out-of-bounds read issue exists in the Apache Thrift c glib bindings, specifically occurring within the transport leftover-bytes path. An out-of-bounds read is a condition where a program...

PT-2026-65065

Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6 Description An integer underflow exists in the multipart MIME body parser. Unauthenticated remote attackers can crash the server process by sending a crafted Content-Disposition header with an empty field...

Security Advisory 0144

Security Advisory 0144 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 3, 2026 | Updated Affected Platforms to include: VeloCloud Orchestrator Hosted 1.2 | August 10, 2026 | Added CSAF JSON file for download The CVE-ID tracki...