PT-2026-7273

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.4.3 through 6.4.16 Fortinet FortiOS versions 7.0 all versions Fortinet FortiOS versions 7.2 all versions Fortinet FortiOS versions 7.4.0 through 7.4.9 Fortinet FortiOS version 7.6.0 Description An issue exists in th...

PT-2026-7472

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.32 Description AutoGPT is a platform for creating, deploying, and managing continuous artificial intelligence agents that automate complex workflows. Versions of AutoGPT before 0.6.32 contain a Regular Expression...

PT-2026-7386

Name of the Vulnerable Software and Affected Versions Substance3D - Designer versions 15.1.0 and earlier Description The software for 3D model texturing, Substance 3D Designer, contains a NULL Pointer Dereference issue. Successful exploitation of this issue could lead to a denial-of-service...

Adobe Bridge 15.1.3 < 15.1.4 / 16.x < 16.0.2 Multiple Vulnerabilities (APSB26-21)

The version of Adobe Bridge installed on the remote Windows host is prior to 15.1.4 or 16.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-21 advisory. - Integer Overflow or Wraparound CWE-190 potentially leading to Arbitrary code execution CVE-2026-21347 -...

MiracleLinux 9 : opentelemetry-collector-0.135.0-3.el9_7 (AXSA:2026-158:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-158:01 advisory. crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 Tenable has extracted the preceding...

The vulnerabilities of the functions qla2x00_async_login_sp_done(), qla2x00_adisc_sp_done(), and qla2x00_prli_sp_done() in the driver module drivers/scsi/qla2xxx/qla_init.c, which is part of the Linux operating system’s SCSI device support driver. These vulnerabilities allow a hacker to cause a service failure.

The vulnerabilities of the functions qla2x00asyncloginspdone, qla2x00adiscspdone, and qla2x00prlispdone in the driver module drivers/scsi/qla2xxx/qlainit.c are related to code errors. Exploiting these vulnerabilities can allow an attacker to cause a service failure...

RHEL 8 : nodejs:20 (RHSA-2026:2422)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:2422 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2025-71154 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71154 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-68803 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-68803 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2025-71084 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71084 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-68796 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-68796 affecting package kernel for versions less than 6.6.121.1-1. A patched version of the package is available...

CVE-2026-25958 Cube privilege escalation via a specially crafted request

Cube is a semantic layer for building data applications. From 0.27.19 to before 1.5.13, 1.4.2, and 1.0.14, it is possible to make a specially crafted request with a valid API token that leads to privilege escalation. This vulnerability is fixed in 1.5.13, 1.4.2, and 1.0.14...

CVE-2026-25895 FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched ...

CVE-2026-25925 PowerDocu Affected by Remote Code Execution via Insecure Deserialization

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2113 more potentially affected by CVE-2026-25528 via langsmith (>=0.3.71, <=0.3.87)

langsmith NPM version =0.3.71, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =2.0.0, =2.2.0 - @adb-storage-m/mem0ai 2.3.2 and more Source cves: CVE-2026-25528 Source advisory: OSV:GHSA-V34V-RQ6J-CJ6P...

CVE-2026-25761 Command injection via crafted filenames in Super-linter Action

Super-linter is a combination of multiple linters to run as a GitHub Action or standalone. From 6.0.0 to 8.3.0, the Super-linter GitHub Action is vulnerable to command injection via crafted filenames. When this action is used in downstream GitHub Actions workflows, an attacker can submit a pull...

CVE-2026-25491 Craft has a Stored XSS in Entry Types Name

Craft is a platform for creating digital experiences. From 5.0.0-RC1 to 5.8.21, Craft has a stored XSS via Entry Type names. The name is not sanitized when displayed in the Entry Types list. This vulnerability is fixed in 5.8.22...

-fides-amor-et-lux (1.0.0), 0xppl-solana-portfolio (1.0.0) +13541 more potentially affected by CVE-2026-25639 via axios (>=1.0.0, <=1.13.4)

axios NPM version =1.0.0, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =2.0.200 and more Source cves: CVE-2026-25639 Source advisory: OSV:GHSA-43FC-JF86-J433...

CVE-2025-10464 Cleartext password storage in Birtech Information Technologies' Sensaway

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the...

CVE-2026-22922 Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this...