Debian dla-4880 : apt - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4880 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4880-1 [email protected] https://www.debian.org/lts/security/...

AlmaLinux 8 : httpd:2.4 (ALSA-2026:92616)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:92616 advisory. httpd: modauthdigest: timing attack allows a bypass of digest authentication CVE-2026-33006 httpd: httpd: HTTP response smuggling via crafted...

CVE-2026-120642: Improper Use of Validation Framework

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires fr...

CVE-2026-121964: FreeRDP: FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where…

FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpcclientrecvfragment writes BINDACK and ALTERCONTEXTRESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the current stream position. A...

Linux Distros Unpatched Vulnerability : CVE-2026-120956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client...

Linux Distros Unpatched Vulnerability : CVE-2026-121098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper state validation in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execu...

Linux Distros Unpatched Vulnerability : CVE-2026-121137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the...

Linux Distros Unpatched Vulnerability : CVE-2026-121388

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations...

Linux Distros Unpatched Vulnerability : CVE-2026-120635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-da...

Linux Distros Unpatched Vulnerability : CVE-2026-121079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn- channel-dump module during session teardown. A malicious RD...

FreeBSD : net/rsync -- denial of service (c70f21b6-d7b4-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c70f21b6-d7b4-11f1-bae2-3497f65b111b advisory. VulnCheck reports: rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer...

CVE-2026-120646: Access of Resource Using Incompatible Type ('Type Confusion')

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global...

Linux Distros Unpatched Vulnerability : CVE-2026-121076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the...

Linux Distros Unpatched Vulnerability : CVE-2026-120648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing --...

Linux Distros Unpatched Vulnerability : CVE-2026-121044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.2 built with WITHAAD=ON contains a reachable assertion because its ARM gateway response parser accepts a missing or non-string...

CVE-2026-118516: sensiolabs symfony: The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently,…

The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently, allowing path-based authorization rules to be bypassed in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. For routes that defi...

CVE-2026-120647: Improper Encoding or Escaping of Output

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...