CVE-2026-15619

CVE-2026-15619 affects mosaxiv clawlet prior to 0.2.10. The vulnerable element is the web_fetch function in tools/tool_web_fetch.go of the IPv4 Handler. The issue arises from manipulating the url argument, enabling server-side request forgery (SSRF). The attack can be initiated remotely, and an e...

PT-2026-58740

Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 150.0.7871.125 Description A use after free issue in the UI allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This occurs when a user is convinced to perform...

PT-2026-58455

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A heap-based buffer overflow exists in the Windows Web Proxy Auto-Discovery Protocol WPAD. This flaw allows an authorized attacker with local access to elevate their privileges on the system....

PT-2026-57985

Name of the Vulnerable Software and Affected Versions Eclipse KUKSA Databroker version 0.6.1 Description The kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data point field in PublishValueRequest. If a request includes a valid signal id but omits data...

PT-2026-58739

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description An inappropriate implementation in the V8 JavaScript engine allows a remote attacker to execute arbitrary code within a sandbox by inducing a user to visit a crafted HTML page...

PT-2026-58539

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting issue, which allows an authorized attacker to perform spoofing over a network...

PT-2026-57996

Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description An issue exists where an HTTP URI containing a semicolon, such as /public;/../admin/secret.txt, results in an unresolved path of /public/../admin/secret.txt instead of the expected...

PT-2026-58285

Name of the Vulnerable Software and Affected Versions Power BI Report Server versions prior to 15.0.1121.120 Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This allo...

PT-2026-57987

In versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacke...

Security Update for Microsoft ASP.NET Core (July 2026)

The Microsoft ASP.NET installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate...

The vulnerability of the Undertow web server, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the Undertow web server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-58075

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.4.0 through 7.4.1 FortiOS versions 7.2.x FortiPAM versions 1.0 through 1.8.2 FortiProxy versions 7.4.0 through 7.4.13 FortiProxy versions 7.2.x Description A stack-based buffer overflow occurs when a privileged authenticated...

PT-2026-58504

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting, which allows an authorized attacker to perform spoofing over a network...

PT-2026-58525

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting, which allows an authorized attacker to perform spoofing over a network...

PT-2026-60097

Name of the Vulnerable Software and Affected Versions nebula-mesh affected versions not specified Description The web handler renderMobileBundle passes a pki.CAResolver to the mobilebundle.Build function, which decrypts the CA's ed25519 private key into a pki.CAManager. However, the Build functio...

Fortinet Fortigate Header injection in Web Filter warning page (FG-IR-26-152)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-152 advisory. - An Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Response Splitting' vulnerability CWE-113 vulnerability ...

PT-2026-58251

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

SIP Sustainable Irrigation Platform 5.x Stored XSS

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, allows attackers to execute arbitrary JavaScript code (XSS).

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

PT-2026-58736

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description A use after free issue in the Core component allows a remote attacker to potentially perform a sandbox escape by inducing the user to visit a crafted HTML page. A use after free occurs...