PT-2026-66830

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

Nikto Web Scanner 2.6.1

Nikto is an Open Source web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers...

PT-2026-66861

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.15.0 Description An authorization bypass exists in servers using the --mobility configuration. The system authenticates a resumed REFRESH request using the resuming user's credentials but fails to verify that identit...

PT-2026-66745

Name of the Vulnerable Software and Affected Versions Apache HttpComponents Client versions 5.0-alpha1 through 5.6.2 Description HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager when it encounters an invalid or unsupport...

CVE-2026-51785

An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request...

PT-2026-66750

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

📄 velocityjs 2.1.5 Prototype Pollution

A proof of concept exploit for velocityjs versions 0.3.1 through 2.1.5 that contain a prototype pollution vulnerability. The exploit abuses an unvalidated set left-hand path to write arbitrary properties into Object.prototype, enabling authorization bypasses and, on Node.js 16 and earlier,...

CVE-2026-51785

CVE-2026-51785 affects Hugo Leisink Hiawatha prior to 12.2. The incident is a remote code execution vulnerability triggered by a crafted request to the server. The available connected documents confirm the flaw and the affected version range, with remediation guidance to upgrade to version 12.2 o...

PT-2026-66874

Name of the Vulnerable Software and Affected Versions pion/stun versions prior to 3.1.3 Description A remote denial of service can occur during the parsing of STUN or ICE Binding-response paths. The issue arises when the XORMappedAddress.GetFromAs function processes a malformed short...

OPENSUSE-SU-2026:11410-1 cf-cli-8.18.4+git.0.3fcd823a1-1.1 on GA media

These are all security issues fixed in the cf-cli-8.18.4+git.0.3fcd823a1-1.1 package on the GA media of openSUSE Tumbleweed...

Cisco IOS Software IKEv2 Multiple Vulnerabilities (cisco-sa-asa-ftd-ios-dos-DOESHWHy)

According to its self-reported version, Cisco IOS is affected by multiple vulnerabilities. - A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to...

GitLab 16.6 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-6336)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthoriz...

Linux Distros Unpatched Vulnerability : CVE-2026-55777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios...

GitLab 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-15831)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.3 and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to bypass...

Adobe Bridge < 15.1.7 / 16.x < 16.0.6 Multiple Vulnerabilities (APSB26-89)

The version of Adobe Bridge installed on the remote macOS or Mac OS X host is prior to 15.1.7 or 16.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-89 advisory. - Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary co...

PT-2026-66747

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

PT-2026-66779

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

PT-2026-66677

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description The /view endpoint serves uploaded SVG files inline due to the absence of image/svg+xml and related XML content types from the dangerous-content-type handling. This allows for stored cross-site...

tomcat-9.0.120-1.1 on GA media (moderate)

tomcat-9.0.120-1.1 on GA media Announcement ID: openSUSE-SU-2026:11399-1 Rating: moderate Cross-References: CVE-2026-59083 CVE-2026-59084 CVSS scores: CVE-2026-59083 SUSE : 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVE-2026-59084 SUSE : 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L...

PT-2026-66836

Name of the Vulnerable Software and Affected Versions Thumbor versions prior to 7.8.0 Description The ALLOWED SOURCES configuration, designed to restrict the hosts from which the HTTP loader fetches images, fails to escape dots when processing plain-string entries. These strings are passed direct...