PT-2026-123219

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.21-tuxcare.4...

PT-2026-123220

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.30-tuxcare.12...

PT-2026-123221

TuxCare rebuilt 24 org.springframework packages to address 1 CVE. Fixed in 5.3.24-tuxcare.10...

PT-2026-123222

TuxCare rebuilt bower to address 1 CVE. Fixed in 1.8.14-tuxcare.2...

PT-2026-123223

TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.2.3-tuxcare.2...

PT-2026-123225

TuxCare rebuilt nodemailer to address 3 CVEs. Fixed in 9.0.0-tuxcare.3...

PT-2026-123228

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.6-tuxcare.1...

PT-2026-123232

TuxCare rebuilt qs to address 1 CVE. Fixed in 6.15.3-tuxcare.3...

PT-2026-123233

TuxCare rebuilt nodemailer to address 1 CVE. Fixed in 9.0.6-tuxcare.2...

PT-2026-123224

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.3-tuxcare.3...

PT-2026-123226

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.2-tuxcare.3...

PT-2026-123227

TuxCare rebuilt 47 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9...

PT-2026-123229

TuxCare rebuilt 6 org.springframework.pulsar packages to address 1 CVE. Fixed in 1.1.12-tuxcare.1...

PT-2026-123230

TuxCare rebuilt nodemailer to address 2 CVEs. Fixed in 9.0.5-tuxcare.3...

PT-2026-123231

TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.8-tuxcare.2...

PT-2026-123234

TuxCare rebuilt handlebars to address 7 CVEs. Fixed in 4.5.3-tuxcare.3...

PT-2026-123235

TuxCare rebuilt react-router to address 2 CVEs. Fixed in 7.15.0-tuxcare.2...

PT-2026-123236

TuxCare rebuilt axios to address 9 CVEs. Fixed in 1.17.0-tuxcare.2...

PT-2026-123237

TuxCare rebuilt 7 org.springframework.ldap packages to address 1 CVE. Fixed in 3.2.16-tuxcare.1...

PT-2026-115975

Name of the Vulnerable Software and Affected Versions Microsoft Authentication Library MSAL for Node.js affected versions not specified Description An origin validation error allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no...

PT-2026-115383

FreeRDP from 2.0.0 before 3.32.0 contains an unbounded reassembly vulnerability in WTSProcessChannelData that fails to enforce cumulative fragment limits. Authenticated clients can start a static virtual channel message, withhold the LAST flag, and send endless fragments to exhaust server memory...

PT-2026-115617

Name of the Vulnerable Software and Affected Versions MultipartInputStream affected versions not specified Description MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. A crafted multipart input can force excessive boundary comparisons and repeated copyin...

PT-2026-115521

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3...

PT-2026-116121

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id ...

PT-2026-115881

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS INITIAL WINDOW SIZE values...

PT-2026-115880

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

PT-2026-115888

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector a...

PT-2026-115104

Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77...

PT-2026-114822

Name of the Vulnerable Software and Affected Versions bhyve affected versions not specified Description The framebuffer device model contains duplicated maximum resolution constants between the framebuffer and RFB modules that are out of sync. Furthermore, writes to the framebuffer BAR allow the...

PT-2026-115217

XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery CSRF vulnerability in the user management controller JobUserController. The endpoints /user/insert, /user/update, and /user/delete lack CSRF protection and do not restrict HTTP method...

PT-2026-114960

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.php, application/Espo/Tools/Export/Format/Xlsx/OpenSpoutProcessor.php, and application/Espo/Tools/Export/Format/Xlsx/PhpSpreadsheetProcessor.php inspect only...

PT-2026-115310

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.11.1 Description Multi-team provisioning in the Apache Airflow Keycloak provider allows every team role to have global read access to audit logs. This occurs within the attach team...

PT-2026-115071

Name of the Vulnerable Software and Affected Versions Nutanix Prism Element versions prior to 7.6.0.8 Nutanix Prism Element versions prior to 7.5.2 Nutanix Prism Element versions prior to 7.3.1.18 Nutanix Prism Central versions prior to 7.6.0.8 Nutanix Prism Central versions prior to 7.5.2 Nutani...

PT-2026-115090

Attackers converted grocery store refrigeration systems into heating units, reaching 50°C 120°F across 400+ European stores. They exploited Internet-exposed Danfoss controllers via CVE-2024-41450/41451/41452, then moved laterally through OT networks to coordinate simultaneous temperature...

PT-2026-115191

pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values...

PT-2026-114791

Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data Manipulation. This issue affects Vyond: before be6e297b0c4836e20d73b2f8a40a561ea496ebaa...

PT-2026-114810

When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the now-mapped buffer...

PT-2026-115330

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code...

PT-2026-115195

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services dyndns edit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

PT-2026-115219

Name of the Vulnerable Software and Affected Versions EnergizeLab Eilik and EilikO affected versions not specified Description The AI skill upload endpoint, served by the FastAPI AI inference and profiling services, lacks authentication and does not restrict uploaded file paths. This allows an...

PT-2026-114896

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution...

PT-2026-115368

Name of the Vulnerable Software and Affected Versions Sliver versions prior to 1.7.3 Description Sliver is subject to a Denial of Service DoS issue where an unauthenticated user can exhaust the server's RAM, potentially crashing the host device. The issue occurs when an open HTTP listener receive...

PT-2026-115076

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager...

PT-2026-115189

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes a...

PT-2026-115369

Name of the Vulnerable Software and Affected Versions Backuply versions prior to 1.5.9 Description Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs wh...

PT-2026-114936

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing...

PT-2026-115322

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description A use after free issue exists in V8, which is the open-source JavaScript and WebAssembly engine used in Google Chrome. A remote attacker can execute arbitrary code within the sandbox by...

PT-2026-122709

Security vulnerability affects the langfuse package. Next...

PT-2026-122812

Security vulnerability affects the argo-cd package. go-git is an extensible git implementation library written in pure Go...

PT-2026-122692

Security vulnerability affects the strimzi-kafka-operator package. Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform...