PT-2026-90945

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf list count of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cifs-utils (UTSA-2026-054012)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054012 advisory. cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file. Tenabl...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cifs-utils (UTSA-2026-054013)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054013 advisory. In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges...

ROOT-APP-NPM-CVE-2026-46681 CVE-2026-46681 in @nevware21/ts-utils - Patched by Root

Root has patched CVE-2026-46681 in the @nevware21/ts-utils package for Root:npm. Multiple fixed versions available...

CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

UBUNTU-CVE-2026-79522

An out-of-bounds read in the gfdmgetchunkdata function src/utils/downloader.c of GPAC v26.07.0 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640...

xz security update

An update is available for xz. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list XZ Utils is an integrated collection of user-space file compression utilities bas...

RLSA-2026:64787 Moderate: xz security update

XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm LZMA, which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fixes: xz: XZ Utils:...

MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

CVE-2026-88002: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id...

TencentOS Server 4: iscsi-initiator-utils (TSSA-2026:0983)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0983 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

AlmaLinux 10 : xz (ALSA-2026:64787)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:64787 advisory. xz: XZ Utils: Denial of Service via buffer overflow in index decoding CVE-2026-34743 Tenable has extracted the preceding description block directly from the...

CVE-2026-87015: Insertion of Sensitive Information Into Sent Data

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/openwebui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached...

RockyLinux 10 : xz (RLSA-2026:64787)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:64787 advisory. xz: XZ Utils: Denial of Service via buffer overflow in index decoding CVE-2026-34743 Tenable has extracted the preceding description block directly from the...

xz: XZ Utils: Denial of Service via buffer overflow in index decoding

A flaw was found in XZ Utils. When the lzmaindexdecoder function processes an empty index, and a subsequent lzmaindexappend operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service DoS for affected systems...

RHEL 10 : xz (RHSA-2026:64787)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:64787 advisory. XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv- Markov chain algorithm LZMA, which performs...

EulerOS 2.0 SP12 : nfs-utils (EulerOS-SA-2026-3360)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

EulerOS 2.0 SP12 : cifs-utils (EulerOS-SA-2026-3252)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...

EulerOS 2.0 SP12 : cifs-utils (EulerOS-SA-2026-3327)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...