CVE-2026-110359

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges...

EUVD-2026-100757

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive...

CVE-2026-110359

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges...

EUVD-2026-100760

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions. A local user can exploit this to escalate privileges...

CVE-2026-110359

Hyland Desktop Host for Windows versions before 25.1.1 is vulnerable to local privilege escalation . The root cause is a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions (CWE-276). A local user can exploit these insufficient permissions to esca...

PT-2026-114300

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw exists in the lib/vhost library where memory size is not adequately validated before the mmap operation during vhost memory-region setup. This lack of validation can result in memory...

PT-2026-113639

Improper neutralization of special elements in the NetBird client SSH configuration manager client/ssh/config/manager.go in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts. The client writes a system-wide...

Linux Distros Unpatched Vulnerability : CVE-2026-86849

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer ...

Linux Distros Unpatched Vulnerability : CVE-2026-86561

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memo...

Linux Distros Unpatched Vulnerability : CVE-2026-86856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leadin...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2026-130041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130041 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

PT-2026-114310

Name of the Vulnerable Software and Affected Versions DPDK affected versions not specified Description A flaw exists in the DPDK lib/vhost vhost-crypto backend. An integer overflow occurs during chain length checks, combined with missing length checks on the RSA path, which can lead to a host...

PT-2026-114303

Name of the Vulnerable Software and Affected Versions DPDK versions prior to 25.11.4-1.1 Description A flaw in the lib/vhost library allows a guest to desynchronize the virtqueue size from the inflight descriptor table size. This synchronization failure leads to an out-of-bounds write within the...

PT-2026-113739

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description A logic flaw in the curl command line tool prevents SSH host verification options from being applied when a connection is established via a redirect. Specifically, if the initial request is HTTPS a...

PT-2026-114311

Name of the Vulnerable Software and Affected Versions DPDK nfp vDPA driver affected versions not specified Description A flaw in the nfp vDPA driver allows stack and heap buffers, which are sized for a single queue pair, to be overflowed when multiple virtqueues are configured. This can result in...

PT-2026-114421

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 8.23.0-1.1 Description When libcurl utilizes libssh2 with a hashed known hosts file, an unrelated initial entry can lead to incorrect host key validation. Specifically, the system may report a key mismatch as a missin...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130123 advisory. Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through...

CVE-2026-105390

The OpenVPN ovpn-dco-win component for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 is vulnerable to a deadlock caused by improper synchronization . A local attacker can trigger this condition by performing a crafted write to the ovpn-dco device , which results in the host becomin...

CVE-2026-105390

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive...

MAL-2026-17879 Malicious code in @flexmr/ui (npm)

@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...