Linux Distros Unpatched Vulnerability : CVE-2026-121065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy...

Linux Distros Unpatched Vulnerability : CVE-2026-121066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Linux Distros Unpatched Vulnerability : CVE-2026-121038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

CVE-2026-90632: Apache Software Foundation Apache OpenOffice: Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the…

Apache OpenOffice documents can include multimedia content audio, video, etc. A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for exampl...

FreeBSD : net/rsync -- denial of service (c70f21b6-d7b4-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c70f21b6-d7b4-11f1-bae2-3497f65b111b advisory. VulnCheck reports: rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer...

CVE-2026-102337: webmin: Webmin is a web-based system administration tool for Unix-like servers

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not...

CVE-2026-121608: Qihoo 360: A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2

A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function onpushmessage of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may b...

CVE-2026-92188: Quest Foglight for Databases: Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability

Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is not required to exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-119776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all prior released versions of FRRouting, the OSPFv3 for IPv6 implementation does not check that OSPFv3 packets have a link-local source address and either a...

CVE-2026-119746: ProSoft Technology: ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module…

ProSoft Technology ICX35 devices X35-HWC-A and ICX35-HWC-E contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and...

CVE-2026-13289: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2026-13284: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-121081

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to obtain sensitive informatio...

Linux Distros Unpatched Vulnerability : CVE-2026-121096

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. Chromium security severity: Medium...

CVE-2026-13271: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD Managed File Transfer could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to...

CVE-2026-39430: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management…

On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management and access controls are not enforced device-side. Thus, an unauthenticated user can change administrator-level settings without logging in via a modified client that bypasses the...

CVE-2026-54383: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated…

VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using...

CVE-2026-54382: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role…

VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being restricted to their own folder. Attackers can overwrite oth...

CVE-2026-54381: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows…

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881...

CVE-2026-54380: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated…

VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure to restrict scripts or force downloads...