Important: dovecot security, bug fix, and enhancement update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fixes: doveco...

CentOS 9 : sudo-1.9.17p2-5.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the sudo-1.9.17p2-5.el9 build changelog. - TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization rhel-9.10 CVE-2026-96512 Note that Nessus has not tested for...

RockyLinux 8 : sudo (RLSA-2026:75580)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75580 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

PT-2026-107275

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts...

PT-2026-107220

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea Actions incorrectly determined if a fork pull request run required approval by checking the user who triggered the event instead of the pull request author. When a maintainer performed...

PT-2026-107195

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An issue exists in the affected interface of ClearPass Policy Manager that may allow an unauthenticated remote attacker to bypass authentication controls. This could lead to...

PT-2026-107191

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager affected versions not specified Description Authentication bypass flaws exist in the web-based management and API interfaces. These issues allow an unauthenticated remote attacker to circumvent...

PT-2026-107182

Name of the Vulnerable Software and Affected Versions Handlebars versions 4.0.0 through 4.7.9 Description Handlebars.compile and Handlebars.precompile functions accept pre-parsed AST Abstract Syntax Tree objects but only validate specific PathExpression, NumberLiteral, and BooleanLiteral values...

PT-2026-106788

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload versions prior to 4.0.0-canary.34 Description The server fails to correctly enforce a field-level access.update restriction on the password field within an authentication collection. This allows the...

PT-2026-106873

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description Missing authorization in the FileSystem component allows a remote attacker who has compromised the renderer process to bypass the web origin policy, which is a security mechanism that...

PT-2026-106871

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106851

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim...

PT-2026-106846

In is pd allowed of gem msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

PT-2026-106894

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

PT-2026-106808

Name of the Vulnerable Software and Affected Versions @payloadcms/db-mongodb versions prior to 3.87.0 @payloadcms/db-mongodb canary versions prior to 4.0.0-canary.20 Description An authenticated user with permissions to update a document can modify fields that should be restricted by field-level...

PT-2026-106800

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-s3 versions prior to 3.90.0 @payloadcms/storage-s3 canary versions prior to 4.0.0-canary.34 Description An authenticated user can overwrite an existing S3 object belonging to another upload collection. This occurs when clie...

PT-2026-106783

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions prior to 4.0.0-canary.34 Description An access-control bypass exists in the duplicate operation, which allows the copying of values from a source document even if a field is hidden or if t...

PT-2026-106880

Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106874

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. Chromium security severity: Low...

PT-2026-106864

Code injection in ReaderMode in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...