PT-2026-120659

Name of the Vulnerable Software and Affected Versions Lagoon versions prior to 2.33.2 Description A flaw in the ssh service within Lagoon core allows an attacker with a valid Lagoon user account to execute arbitrary code, potentially resulting in elevated administrative permissions. Detection of...

Linux Distros Unpatched Vulnerability : CVE-2026-113043

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted...

Red Hat: CVE-2026-114126: storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, the Storybook development server can expose its WebSocket authentication token to clients able to load its HTML pages over a local network. ...

Improper output handling vulnerability in MongoDB Compass

A vulnerability related to improper output handling exists in MongoDB Compass versions from 1.7.0 up to but including 1.49.15. This vulnerability arises because certain BSON values are not properly escaped when converting stored views into editable sources; as a result, it may allow arbitrary cod...

Lovell Fuller sharp resource management error vulnerability

Versions of Lovell Fuller Sharp prior to 0.35.5 contain a resource management error vulnerability. This vulnerability stems from memory-related issues in the bundled librsvg dependency. An attacker can supply specially crafted SVG images; upon decoding via librsvg by Sharp, this may lead to...

Mandiant FLARE Capa deserialization injection vulnerability

Versions of Mandiant FLARE prior to Capa 10.0.0 contain a deserialization injection vulnerability. This vulnerability arises from the Capa tool’s inability to properly handle untrusted data during the processing of specially crafted .viv or .exe.viv workstations, potentially leading to arbitrary...

MariaDB Buffer Overflow DoS

The vulnerability of the MariaDB database management system is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

libsvg Heap Buffer Overflow DoS

The vulnerability of the SVG vector graphics rendering library, librsvg, is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a service failure...

Google Chrome Desktop Code Execution

The vulnerability of the Google Chrome browser’s Desktop component is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4594-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4594-1 advisory. This update for emacs fixes the following issue: - CVE-2026-96442: arbitrary code execution when viewing or editing...

Rocky Linux 9 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc (crlsa-2026_85791)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685791 advisory. pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 Tenable has extracted the preceding description blo...

RHEL 9 : xorg-x11-server (RHSA-2026:82015)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82015 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical us...

RockyLinux 8 : libxml2 (RLSA-2026:71641)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:71641 advisory. libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer overflow...

Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

[ASA-202610-1] php: arbitrary code execution

Arch Linux Security Advisory ASA-202610-1 ========================================= Severity: Critical Date : 2026-10-21 CVE-ID : CVE-2026-109618 CVE-2026-109619 Package : php Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2909 Summary ======= The package p...

[ASA-202610-2] php-legacy: arbitrary code execution

Arch Linux Security Advisory ASA-202610-2 ========================================= Severity: Critical Date : 2026-10-21 CVE-ID : CVE-2026-109618 CVE-2026-109619 Package : php-legacy Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2910 Summary ======= The...

AlmaLinux 9 : xorg-x11-server (ALSA-2026:84574)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84574 advisory. xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server:...

GitLab 7.0 < 18.11.13 / 19.0 < 19.0.10 / 19.1 < 19.1.9 / 19.2 < 19.2.9 / 19.3 < 19.3.6 / 19.4 < 19.4.3 / 19.5 < 19.5.1 (CVE-2026-110264)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and...

Debian dsa-6574 : libapache2-mod-php8.4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6574 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6574-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-107651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Eye of GNOME eog. A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata...