Cisco IOS Software IKEv2 Multiple Vulnerabilities (cisco-sa-asa-ftd-ios-dos-DOESHWHy)

According to its self-reported version, Cisco IOS is affected by multiple vulnerabilities. - A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to...

GitLab 16.6 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-6336)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthoriz...

Adobe Bridge < 15.1.7 / 16.x < 16.0.6 Multiple Vulnerabilities (APSB26-89)

The version of Adobe Bridge installed on the remote macOS or Mac OS X host is prior to 15.1.7 or 16.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-89 advisory. - Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary co...

PT-2026-66836

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed direct...

PT-2026-66834

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant url value containing a dangerous URI scheme. T...

PT-2026-66779

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

PT-2026-66747

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

OPENSUSE-SU-2026:11412-1 evince-48.4-2.1 on GA media

These are all security issues fixed in the evince-48.4-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-66873

Name of the Vulnerable Software and Affected Versions sigstore-go versions prior to 1.2.1 Description The library fails to verify the bundle signing timestamp against the validity window of an ExpiringKey when using a self-managed long-lived signing key without a certificate. This allows an...

tomcat-9.0.120-1.1 on GA media (moderate)

tomcat-9.0.120-1.1 on GA media Announcement ID: openSUSE-SU-2026:11399-1 Rating: moderate Cross-References: CVE-2026-59083 CVE-2026-59084 CVSS scores: CVE-2026-59083 SUSE : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2026-59084 SUSE : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L...

MiracleLinux 9 : python3.14-3.14.5-1.el9_8 (AXSA:2026-1397:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1397:02 advisory. python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open API CVE-2026-4786 python: Python: Cross-Site Scripting XS...

GitLab 18.4 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-4672)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

PT-2026-66843

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

EUVD-2026-51645

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

Fedora 44 : php (2026-6131a972fe)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6131a972fe advisory. PHP version 8.5.9 30 Jul 2026 Core: Fixed bug GH-22290 AST pretty printing does not correctly handle strings containing NUL. iliaal Fixed bug GH-222...

PT-2026-66866

Name of the Vulnerable Software and Affected Versions xxl-job version 3.4.0 Description A Server-Side Request Forgery SSRF exists in the 'xxl-job-admin/jobinfo/trigger' endpoint. This issue allows authenticated attackers to scan internal resources by sending a specially crafted HTTP request. SSRF...

CVE-2026-38710

CVE-2026-38710 affects TR1200 v2.4.15 and TR3000 v2.4.21. The issue is a command injection in the system.setclock interface that allows an attacker to execute arbitrary commands as root via crafted input. Impact is described as root-level command execution; no exploitation details or mitigations ...

PT-2026-66864

Name of the Vulnerable Software and Affected Versions libiec61850 version 1.6 Description An issue exists in the parseGoosePayload function located in /goose/goose receiver.c that allows attackers to bypass authentication by using a captured GOOSE frame. GOOSE Generic Object Oriented Substation...