RockyLinux 10 : kernel (RLSA-2026:93413)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:93413 advisory. kernel: Kernel: Denial of Service in network socket error handling CVE-2026-22977 kernel: x86/CPU/AMD: Prevent improper isolation of shared resources i...

Linux Distros Unpatched Vulnerability : CVE-2026-120064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number...

CVE-2026-121106: Google Chrome: Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak…

Information leak in Omnibox in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to leak sensitive information via UI Interaction. Chromium security severity: Medium...

CVE-2026-121179: Google Chrome: Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121405: FreeRDP: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious…

FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a...

CVE-2026-108056: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-120755: The HDF Group Szip Filter: HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Z__filter_szip() in src/H5Zszip.c

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Zfilterszip in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated...

CVE-2026-85034: zephyrproject zephyr: The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or…

The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to btgattsubscribeparams::notify callbacks using only the length derived from the received ATT PDU. btattrecv in subsys/bluetooth/host/att.c...

CVE-2026-99243: Linux: In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation…

In the Linux kernel, the following vulnerability has been resolved: io-wq: order the exit bit against worker creation task work iowqexitworkers cancels task work for queued worker creation with taskworkcancelmatch. That has a plain load of task-taskworks. ioqueueworkercreate adds the new entry an...

CVE-2026-121394: FreeRDP: FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious…

FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfxrlgrdecode and...

CVE-2026-121422: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to…

SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443,...

CVE-2026-65107: NVIDIA Slurm: NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file…

NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to...

CVE-2026-121429: AzuraCast: AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission…

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh ...

CVE-2026-28335: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution

SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required...

CVE-2026-99265: Linux: In the Linux kernel, the following vulnerability has been resolved: io_uring/openclose: keep the lock in…

In the Linux kernel, the following vulnerability has been resolved: iouring/openclose: keep the lock in iopipefixed iopipefixed installs both ends of the pipe in the fixed file table, drops -uringlock, and copies the slot numbers to the application. If that faults, it takes the lock again and...

CVE-2026-121399: FreeRDP: FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD…

FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdgreceivepacket that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication...

CVE-2026-121438: lepture mistune: Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to…

Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parselink that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of nested bracket pairs not forming a valid link, triggering...

CVE-2026-113593: djangoproject Django: An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cachepage decorator generate identical cache keys for requests that omit a header listed in the response’s Vary...

CVE-2026-121587: coollabsio coolify: Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to…

Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main,...

CVE-2026-108054: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...