PT-2026-64893

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Apache Thrift Python bindings contain an issue where certificates with host mismatches are not properly validated. Recommendations Upgrade to version 0.24.0...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

PT-2026-65091

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Ticket...

PT-2026-64891

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An allocation of resources without limits or throttling issue exists in the Apache Thrift Rust bindings. Specifically, the Rust binary protocol non-strict path lacks a string size limit, which...

PT-2026-65065

Name of the Vulnerable Software and Affected Versions facil.io versions 0.6.0 through 0.7.6 Description An integer underflow exists in the multipart MIME body parser. Unauthenticated remote attackers can crash the server process by sending a crafted Content-Disposition header with an empty field...

PT-2026-64880

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper validation of certificates with host mismatch occurs in the Apache Thrift c glib bindings. This issue results in the TLS client failing to perform necessary hostname verification...

PT-2026-64853

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

Atlassian Jira Service Management Data Center and Server 10.0.x / 10.1.1 / 10.2.x / 10.3.x < 10.3.7 / 10.4.x / 10.5.x / 10.6.x / 11.x < 11.3.8 (JSDSERVER-16652)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16652 advisory. - This High severity BASM Broken Authentication & Session Management vulnerability was introduced in...

Security Advisory 0144

Security Advisory 0144 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 3, 2026 | Updated Affected Platforms to include: VeloCloud Orchestrator Hosted 1.2 | August 10, 2026 | Added CSAF JSON file for download The CVE-ID tracki...

SUSE-SU-2026:3254-1 Security update for the Linux Kernel (Live Patch 25 for SUSE Linux Enterprise 15 SP6)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.109 fixes various security issues: The following security issues were fixed: - CVE-2026-23240: tls: Fix race condition in tlsswcancelworktx bsc1262404. - CVE-2026-31738: vxlan: validate ND option lengths in vxlannacreate bsc1264060....

CVE-2026-61108

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: GIS. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged...

CVE-2026-47064

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

CVE-2026-60181

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Configurator. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Difficult to exploit vulnerability allows low...

Exploit for Missing Authentication for Critical Function in Cpanel

cPanel-CVE-2026-41940-auth-bypass-exploit Critical authenticat...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 PoC for Galaxy S24 Ultra SM-S928U1 Device-sp...

CVE-2026-17459

A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possib...

[SECURITY] [DLA 4700-1] linux-6.1 security update

Debian LTS Advisory DLA-4700-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings July 26, 2026 https://wiki.debian.org/LTS Package : linux-6.1 Version : 6.1.177-1deb11u1 CVE ID : CVE-2025-23131 CVE-2026-23272 CVE-2026-23278 CVE-2026-23302 CVE-2026-31451 CVE-2026-46252...

EUVD-2026-49053

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

CVE-2026-17433 nanocoai NanoClaw MCP Server Approval chat-sdk-bridge.ts createChatSdkBridge.setup improper authorization

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached...

EUVD-2026-49048

A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChatSdkBridge.setup of the file src/channels/chat-sdk-bridge.ts of the component MCP Server Approval. Performing a manipulation results in improper authorization. The attack needs to be approached...