SUSE CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104749)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104749 advisory. Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account...

Linux Distros Unpatched Vulnerability : CVE-2026-52489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-104795)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104795 advisory. FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-grunt (UTSA-2026-093223)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093223 advisory. The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of...

RockyLinux 8 : gstreamer1-plugins-base (RLSA-2026:59487)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59487 advisory. gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow CVE-2026-18297 Tenable has extracted the preceding description block directly...

Debian dsa-6468 : emacs - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6468 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6468-1 [email protected] https://www.debian.org/security/ Moritz...

MiracleLinux 8 : sqlite-3.26.0-21.el8_10 (AXSA:2026-1658:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1658:02 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: pcp (UTSA-2026-104832)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104832 advisory. An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite a...

Linux Distros Unpatched Vulnerability : CVE-2026-52491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main component...

PT-2026-81957

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

PT-2026-81932

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...

CVE-2025-70290

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or...

Linux Distros Unpatched Vulnerability : CVE-2026-79175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to...

CVE-2026-74851: Improper Control of Generation of Code

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the...

CVE-2026-58097: Improper Handling of Length Parameter Inconsistency

mpSetEnddisc copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp8 command interface. A local user with access to the ppp8 command interface can crash ppp8 or potentially execute arbitrary code as root...

PT-2026-82240

Name of the Vulnerable Software and Affected Versions Denx U-Boot versions prior to 2026.04 Description An integer overflow exists in the ZFS filesystem support, which can be triggered by malformed on-disk metadata. This flaw may lead to incorrect memory allocation and subsequent out-of-bounds...

CVE-2026-39275

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components...

CVE-2026-58096: Improper Handling of Length Parameter Inconsistency

LcpDecodeConfig did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp8 or potentially execute arbitra...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: thrift (UTSA-2026-032287)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032287 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...