MiracleLinux 8 : dotnet10.0-10.0.113-1.el8_10 (AXSA:2026-2163:22)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2163:22 advisory. dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability CVE-2026-102870 dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Servic...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreoffice (UTSA-2026-147021)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147021 advisory. LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database driver for such a lin...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147029 advisory. A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and write...

PT-2026-132869

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Improper input validation in Skia allows a remote attacker to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome t...

PT-2026-132875

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the DOM Document Object Model, which is the programming interface for HTML and XML documents. This issue allows a remote attacker to potentially execute...

CentOS Linux 6 [TuxCare] Security Update: cups / cups-devel / cups-libs / cups-lpd / cups-php (CENTOS6:CLSA-2026:1793034487)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793034487 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147022)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147022 advisory. An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different maste...

PT-2026-132870

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Improper input validation in the V8 engine allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-132873

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the Quota component, which could allow a remote attacker to potentially execute arbitrary code inside the sandbox by inducing the user to visit a crafted HTM...

J-Web Management Tool Code Execution

The vulnerability in the web interface of the J-Web management tool for Juniper Networks Junos OS and Junos OS Evolved stems from flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code with elevated privileges...

VMware Cloud Foundation SDDC Manager Brotli Decoder Out-of-Bounds Write (VMSA-2026-0008)

The version of VMware Cloud Foundation SDDC Manager installed on the remote host is 5.2.x, 9.0.x, 9.1.0, or 9.1.1. It is, therefore, affected by a remote code execution vulnerability in the Brotli decoder of its Node.js component as referenced in the VMSA-2026-0008 advisory: - A buffer overflow...

CVE-2026-90866: Progress Software WS_FTP Server: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows…

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

docat-org docat arbitrary file upload vulnerability

Docat-org: Versions prior to 1.6.0 of Docat contain an arbitrary file upload vulnerability. This vulnerability arises because the Upload API fails to validate the path or type of uploaded files, potentially allowing unauthorized file uploads. Such uploads may overwrite sensitive configuration fil...

Microsoft Edge (Chromium-based) resource management error vulnerability

Microsoft Edge Chromium-based versions prior to 154.0.4258.37 contain a resource management error vulnerability stemming from double-free conditions. This vulnerability may allow unauthorized attackers to execute code over the network...

PT-2026-132376

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

PT-2026-132299

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PT-2026-132288

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

PT-2026-132855

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions prior to 13.1.0.334 Description An unauthenticated attacker can perform remote code execution RCE on servers running the Veeam Virtualization Extensions service. This allows the attack...

PT-2026-132234

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs...

Frappe path traversal vulnerability

Versions prior to Frappe 15.121.0 and versions 16.x prior to 16.34.0 contain a path traversal vulnerability. This vulnerability arises because file upload processing fails to validate target paths before writing them to disk. As a result, authenticated attackers may upload specially crafted files...