PT-2026-66830

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media

These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...

Adobe Bridge < 15.1.7 / 16.x < 16.0.6 Multiple Vulnerabilities (APSB26-89)

The version of Adobe Bridge installed on the remote macOS or Mac OS X host is prior to 15.1.7 or 16.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-89 advisory. - Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary co...

Cisco IOS Software IKEv2 Multiple Vulnerabilities (cisco-sa-asa-ftd-ios-dos-DOESHWHy)

According to its self-reported version, Cisco IOS is affected by multiple vulnerabilities. - A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to...

GitLab 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-15831)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass...

Linux Distros Unpatched Vulnerability : CVE-2026-55777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios...

GitLab 16.6 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-6336)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthoriz...

PT-2026-66836

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed direct...

PT-2026-66873

Name of the Vulnerable Software and Affected Versions sigstore-go versions prior to 1.2.1 Description The library fails to verify the bundle signing timestamp against the validity window of an ExpiringKey when using a self-managed long-lived signing key without a certificate. This allows an...

PT-2026-66834

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant url value containing a dangerous URI scheme. T...

PT-2026-66779

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

PT-2026-66747

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

OPENSUSE-SU-2026:11412-1 evince-48.4-2.1 on GA media

These are all security issues fixed in the evince-48.4-2.1 package on the GA media of openSUSE Tumbleweed...

tomcat-9.0.120-1.1 on GA media (moderate)

tomcat-9.0.120-1.1 on GA media Announcement ID: openSUSE-SU-2026:11399-1 Rating: moderate Cross-References: CVE-2026-59083 CVE-2026-59084 CVSS scores: CVE-2026-59083 SUSE : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2026-59084 SUSE : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L...

GitLab 18.4 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-4672)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

MiracleLinux 9 : python3.14-3.14.5-1.el9_8 (AXSA:2026-1397:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1397:02 advisory. python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open API CVE-2026-4786 python: Python: Cross-Site Scripting XS...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

PT-2026-66843

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

EUVD-2026-51645

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...