kernel: XFS data corruption using reflink

A flaw was found in the XFS filesystem. A race condition in the copy-on-write mechanism for reflinked files can cause writes to bypass the copy-on-write process and modify shared data blocks directly. As a result, data intended for a private copy may be written to the original shared location,...

PT-2026-60484

Name of the Vulnerable Software and Affected Versions @prompty/core versions 2.0.0-alpha.1 through 2.0.0-beta.2 Description The @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts uses gray-matter without overriding executable js and javascript frontmatter...

ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution...

PT-2026-60475

Name of the Vulnerable Software and Affected Versions PipeWire affected versions not specified Description A flaw in the PulseAudio compatibility layer of PipeWire, a multimedia server, allows an attacker to escape sandboxed applications, such as Flatpak. An attacker with minimal permissions with...

Linux Distros Unpatched Vulnerability : CVE-2026-11386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An input validation and injection vulnerability exists in Canonical ubuntu-pro-client formerly ubuntu- advantage-tools. The client constructs APT source files...

MiracleLinux 8 : freerdp-2.11.7-10.el8_10 (AXSA:2026-1270:23)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1270:23 advisory. freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution CVE-2026-45700 Tenable has extracted the preceding description...

PT-2026-60425

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.1 Snowflake Connector for Python versions prior to 3.18.1 Description Improper TLS hostname verification allows a network-positioned attacker to bypass certificate hostname validation on HTT...

JetBrains TeamCity < 2026.1.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2026.1.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration CVE-2026-59793 - In JetBrains TeamCity before...

Mitel 6800 / 6900 / 6900w Series SIP Phone Argument Injection Vulnerability (CVE-2024-41710)

According to its self-reported version, the remote Mitel IP Phone running SIP Software is affected by an argument injection vulnerability: - A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, through R6.4.0.HF1 R6.4.0.136 could allow an authenticated attacker with...

The vulnerability of the Adobe Animate software for creating multimedia and computer animations lies in its failure to address the issue of eliminating special elements used in the operating system’s command line. This allows attackers to execute arbitrary code.

The vulnerability of the Adobe Animate software for creating multimedia and computer animations is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows an attacker to execute arbitrary code...

libyang security update

2.1.148-4 - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177026 - CVE-2026-44673...

PT-2026-60564

Name of the Vulnerable Software and Affected Versions Whistle versions prior to 2.10.3 Description An issue exists in the way the software handles the 'GET /cgi-bin/temp/get' endpoint. The system reads the filename variable from the query string and only joins it to the temporary files path if it...

MiracleLinux 9 : httpd-2.4.62-13.el9_8.1 (AXSA:2026-1272:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1272:07 advisory. httpd: modproxyajp: heap-based buffer over-read and memory disclosure in ajpparsedata CVE-2026-34059 httpd: modproxyajp: heap-based buffer over-read...

The vulnerability of the Vim text editor, related to improper handling of code generation, allows a hacker to execute arbitrary code.

The vulnerability of the Vim text editor is related to improper handling of code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

PT-2026-60694

Name of the Vulnerable Software and Affected Versions Pheditor versions prior to 2.0.5 Description An authenticated user with terminal permissions can bypass the command whitelist to execute arbitrary shell commands as the web server user. The terminal feature verifies if the submitted command...

KLA91157 Multiple vulnerability in Microsoft Apps

Multiple vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to bypass security restrictions, execute arbitrary code. Original advisories CVE-2026-59117 Exploitation CVE list CVE-2026-59117 critical KB list Solution Install necessary updates from the KB...

flatpak security update

1.16.0-9.1 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157...

PT-2026-61613

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.14.5 Description Issues in the Cluster Distributed API DAPI handling allow a cluster peer or any actor authenticated to the cluster channel using the shared cluster key to force the master node to deserialize and...

PT-2026-60459

Name of the Vulnerable Software and Affected Versions ubuntu-pro-client affected versions not specified Description An input validation and injection issue exists where the client constructs APT source files using data from the contract server response via the directives.suites and...

The vulnerability of the metadata processing mechanism in the repomd.xml repository file of the libzypp library allows a perpetrator to execute arbitrary code.

The vulnerability of the file metadata processing mechanism in the repomd.xml repository of the libzypp library is related to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...