PT-2026-78942

Name of the Vulnerable Software and Affected Versions Capella versions prior to 2.5.6 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...

PT-2026-79153

Name of the Vulnerable Software and Affected Versions IBM AIX version 7.2 IBM AIX version 7.3 IBM PowerVM VIOS version 4.1 Description A heap-based buffer overflow allows a local attacker to gain elevated privileges. A heap-based buffer overflow occurs when a program writes more data to a heap...

PT-2026-79040

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

DEBIAN-CVE-2026-76885

Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...

@agiflowai/aicode-toolkit (>=1.2.0, <=1.3.0), @agiflowai/one-mcp (>=0.4.1, <=0.4.2) +30 more potentially affected by CVE-2026-61556 via liquidjs (>=10.26.0, <=10.27.0)

liquidjs NPM version =10.26.0, =1.2.0, =0.4.1, =1.2.0, =1.1.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =36.0.0-rc.0, =0.0.1-beta.0, =3.0.0, =0.5.0, =0.3024.0, =0.3024.0, =1.1.1 and more Source cves: CVE-2026-61556 Source advisory: SNYK:JS-LIQUIDJS-19006352...

CVE-2026-63335 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, nuxeo, zipkin, conductor-fips, thingsboard, logstash-fips, conductor, logstash, druid...

EUVD-2026-62756

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...

CVE-2026-44901 Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge in framework/wazuh/core/results.py trusts the sortcasting field in a cluster worker's JSON response. During a distributed API merge...

EUVD-2026-62498

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory 6.2.3 - Recipient address was taken from the request contactidoffer / contactidevent instead of the server-side offer/event record, so mail could be sent to an arbitrary address...

EUVD-2026-62496

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

MINI-MGWH-PV97-W83H

Bulletin has no description...

UBUNTU-CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

MINI-C36X-PH8P-RHPG

Bulletin has no description...

EUVD-2026-62376

Subscriber SQL Injection in Community by PeepSo = 9.0.5.2 versions...

PT-2026-78340

Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...

PT-2026-78852

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Wireshark versions 4.4.0 through 4.4.18 Description A crash in the sharkd component occurs due to an expired pointer dereference, which can lead to a denial of service. Recommendations Update Wireshark...

CVE-2026-50167 Kurrier: Authenticated cross-user authorization bypass in Kurrier API

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

NPM: MagicMirror: ssrf calendar .js

NPM: MagicMirror: ssrf calendar .js vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell

CodeWhale versions before 0.8.64 fail to properly validate the allowshell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

UBUNTU-CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...