Linux Distros Unpatched Vulnerability : CVE-2026-106574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791396690)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791396690 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache...

Linux Distros Unpatched Vulnerability : CVE-2026-106570

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : RabbitMQ Server vulnerability (USN-8869-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8869-1 advisory. It was discovered that RabbitMQ Server incorrectly handled certain HTTP/2 headers. An attacker could possibly use this issue to cause a...

VulnCheck KEV: CVE-2026-26216

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

PT-2026-107710

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

PT-2026-107675

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 3.5.4 Description Four critical flaws affect the repo-server and clusters, including an AppProject hook bypass. Approximately 62.1k instances are identified globally. Recommendations Upgrade to version 3.5.4...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2026:77371)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77371 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Conne...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1791413715)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791413715 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context...

Microsoft Exchange Server Elevation of Privilege (October 2026)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. CVE-2026-96940 Not...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791392163)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791392163 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

Rocky Linux 9 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (crlsa-2026_75673)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted th...

RHEL 10 / 8 / 9 : Red Hat JBoss Web Server 7.0.2 (RHSA-2026:76952)

The remote Redhat Enterprise Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76952 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised ...

PT-2026-107564

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

PT-2026-107557

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, resulting in a server crash. A...

VulnCheck KEV: CVE-2026-29058

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration e.g., configuration...

PT-2026-107553

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 Description An unauthenticated adjacent-network client can cause a denial of service by repeatedly connecting to the distributed pixel cache server, which exhausts the available connections. Recommendatio...

Security Updates for Microsoft Exchange Server (October 2026 OOB)

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability: - Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. CVE-2026-96940...

RockyLinux 8 : freerdp (RLSA-2026:76747)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76747 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

xorg -- Multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X server and Xwayland implementations published by X.Org for which we are releasing security fixes for in xorg-server-21.1.25 and xwayland-24.1.14. CVE-2026-88812: XKB SetGeometry TextDoodad Double Free CVE-2026-93515: Present Extension...