ALSA-2026:93610 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Node.js 24.22.0 Brotli Decoder Remote Code Execution

Node.js version 24.22.0 contains an out-of-bounds write in the Brotli decoder. A proof of concept demonstrates remote code execution through a crafted Brotli-compressed HTTP request. https://packetstorm.news/download/238892...

CVE-2026-58857: Google Android: In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition

In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

D-Link DIR-505 Wireless Router Code Execution

The vulnerability in the main function of the /secmark1524.cgi script within the Web Management CGI interface of the D-Link DIR-505 wireless router software is related to the presence of undocumented configuration commands. Exploitation of this vulnerability may allow a remote attacker to execute...

Important: bind security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

RHEL 8 : freerdp (RHSA-2026:93549)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93549 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Collabora Online Built-in CODE Server Before 26.4.303 OS Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303 contain an unauthenticated OS command injection vulnerability in proxy.php that can result in remote code execution when the CODE server is not running...

PT-2026-135809

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service...

PT-2026-135817

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-120436: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes overflows th...

Oracle Linux 10 : libXi (ELSA-2026-93441)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93441 advisory. - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293447 Tenable has extracted...

PT-2026-135451

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

PT-2026-135454

QuickJS-NG before 0.16.0 contains an integer overflow in js proxy get own property names in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or...

PT-2026-135449

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

PT-2026-135483

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16 Description A path traversal issue exists in the services/users/index.php endpoint. This occurs because the module name parameter is not properly sanitized before being concatenated into an include path...

PT-2026-135405

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option...

CVE-2026-8923: Zohocorp: Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated…

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option...

PT-2026-135810

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Arbitrary Code Execution...

MiracleLinux 8 : aspell-0.60.6.1-23.el8_10 (AXSA:2026-2230:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2230:01 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...