PT-2026-58539

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...

PT-2026-58455

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A heap-based buffer overflow exists in the Windows Web Proxy Auto-Discovery Protocol WPAD. This flaw allows an authorized attacker with local access to elevate their privileges on the system....

PT-2026-57987

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

PT-2026-58285

Name of the Vulnerable Software and Affected Versions Power BI Report Server versions prior to 15.0.1121.120 Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This allo...

Header injection in Web Filter warning page

...

PT-2026-57985

Name of the Vulnerable Software and Affected Versions Eclipse KUKSA Databroker version 0.6.1 Description The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data point field in PublishValueRequest. If a request includes a valid signal id but omits data...

PT-2026-57996

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description An issue exists where an HTTP URI containing a semicolon, such as /public;/../admin/secret.txt, results in an unresolved path of /public/../admin/secret.txt instead of the expected...

The vulnerability of the Undertow web server, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the Undertow web server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Security Update for Microsoft ASP.NET Core (July 2026)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate...

PT-2026-60097

Name of the Vulnerable Software and Affected Versions nebula-mesh affected versions not specified Description The web handler renderMobileBundle passes a pki.CAResolver to the mobilebundle.Build function, which decrypts the CA's ed25519 private key into a pki.CAManager. However, the Build functio...

PT-2026-58504

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting, which allows an authorized attacker to perform spoofing over a network...

PT-2026-58075

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.4.0 through 7.4.1 FortiOS versions 7.2.x FortiPAM versions 1.0 through 1.8.2 FortiProxy versions 7.4.0 through 7.4.13 FortiProxy versions 7.2.x Description A stack-based buffer overflow occurs when a privileged authenticated...

PT-2026-58251

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

PT-2026-58525

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting, which allows an authorized attacker to perform spoofing over a network...

SIP Sustainable Irrigation Platform 5.x Stored XSS

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, allows attackers to execute arbitrary JavaScript code (XSS).

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

Fortinet Fortigate Header injection in Web Filter warning page (FG-IR-26-152)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-152 advisory. - An Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability CWE-113 vulnerability ...

PT-2026-58736

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description A use after free issue in the Core component allows a remote attacker to potentially perform a sandbox escape by inducing the user to visit a crafted HTML page. A use after free occurs...

PT-2026-58908

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out http output plugin allows placeholders such as $tag in the endpoint configuration parameter, and if a placeholder value is derived from untruste...

PT-2026-60080

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When running in server mode, the software fails to restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the...