Linux Distros Unpatched Vulnerability : CVE-2026-15390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP...

AlmaLinux 9.6 [TuxCare] Security Update: pipewire / pipewire-alsa / pipewire-devel / pipewire-doc / etc (ALMALINUX9.6:CLSA-2026:1790174444)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790174444 advisory. - A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak,...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1781514933)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781514933 advisory. - A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, whe...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc (ALMALINUX9.6:CLSA-2026:1787237880)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787237880 advisory. - A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.16 (RHSA-2026:73976)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:73976 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release ...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : FreeIPMI vulnerabilities (USN-8843-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8843-1 advisory. It was discovered that FreeIPMI incorrectly handled certain malformed Fujitsu SEL...

Rocky Linux 9.6 [TuxCare] Security Update: gpsd-minimal / gpsd-minimal-clients Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1769424492)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1769424492 advisory. - gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/drivernmea2000.c file. The...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784108403)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784108403 advisory. - A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writ...

AlmaLinux 8 : postgresql:12 (ALSA-2026:69924)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69924 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql:...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Perl DBI module vulnerabilities (USN-8841-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8841-1 advisory. It was discovered that the Perl DBI module did not correctly handle certain integ...

PT-2026-103552

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal weakness exists in an optional, non-default administrative feature. This flaw allows an authenticated administrator to move files to unintended...

PT-2026-103217

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 = 3.5.51 versions...

ROS-20260930-73-0068

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-103499

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

CVE-2026-103474: Unrestricted Upload of File with Dangerous Type

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...

ROS-20260930-73-0054

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-103320

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.19197 Description An authorization bypass in the scripts debugger allows for arbitrary code execution. Recommendations Update to version 2026.2.19197...

CVE-2026-51866

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

CVE-2026-51866

Versions 0.7.5 through 0.8.0 of DB-GPT are vulnerable to a code injection issue (CWE-94). An attacker can upload a malicious skill via the /api/v1/skills/upload endpoint, which can subsequently be executed during the /api/v1/chat/react-agent flow. The impact includes potential compromise of confi...

PT-2026-103519

Name of the Vulnerable Software and Affected Versions OpenClaw Windows Node versions prior to 2026.7.1 Description An incomplete environment-variable sanitizer in the system.run function fails to block specific variables. Attackers with gateway or agent access can supply GIT CONFIG , DOTNET START...