CVE-2026-55368: h2o: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %errorx, %q when t...

CVE-2026-77690: Zohocorp ManageEngine Key Manager Plus: ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that…

ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target...

CVE-2026-90632: Apache Software Foundation Apache OpenOffice: Apache OpenOffice documents can include multimedia content (audio, video, etc.) A crafted document could exploit the…

Apache OpenOffice documents can include multimedia content audio, video, etc. A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for exampl...

CVE-2026-122148: Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass…

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot...

CVE-2026-20241: Cisco: A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity…

A vulnerability in the authorization mechanism of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an unauthenticated, remote attacker to obtain an endpoint identity certificate. This vulnerability is due to improper authorization checks. An attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-120956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client...

Linux Distros Unpatched Vulnerability : CVE-2026-121066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access...

Linux Distros Unpatched Vulnerability : CVE-2026-121157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 allowed a local attacker to bypass system access restrictions via a local program...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : libmspack vulnerability (USN-8973-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8973-1 advisory. It was discovered that libmspack did not properly initialize pointers when handling errors while reading KWAJ archive headers. An...

TencentOS Server 2: gstreamer-plugins-bad-free (TSSA-2026:1354)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1354 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-121165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Mobile in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI element...

Linux Distros Unpatched Vulnerability : CVE-2026-121095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121141

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy...

Linux Distros Unpatched Vulnerability : CVE-2026-120635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-da...

TencentOS Server 2: glib2 (TSSA-2026:1365)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1365 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-119977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during...

Linux Distros Unpatched Vulnerability : CVE-2026-121176

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-120637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as...

Linux Distros Unpatched Vulnerability : CVE-2026-121167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass syst...

Linux Distros Unpatched Vulnerability : CVE-2026-121190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a...