Oracle Linux 9 : libXi (ELSA-2026-93439)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93439 advisory. - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293452 Tenable has extracted t...

Oracle Linux 10 : libXi (ELSA-2026-93441)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-93441 advisory. - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293447 Tenable has extracted...

CVE-2026-91908: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature…

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution...

PT-2026-135483

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16 Description A path traversal issue exists in the services/users/index.php endpoint. This occurs because the module name parameter is not properly sanitized before being concatenated into an include path...

bind security update

9.16.23-40.0.1.el98.13 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-40.13 - Fix CVE-2026-94300: Arbitrary code execution via GSS-TSIG UDP message replay. - Fix CVE-2026-97313: Denial of Service via assertion failure in RPZ query processing. - Fix CVE-2026-96888:...

PT-2026-135810

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Arbitrary Code Execution...

Collabora Online Built-in CODE Server Before 26.4.303 OS Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303 contain an unauthenticated OS command injection vulnerability in proxy.php that can result in remote code execution when the CODE server is not running...

CVE-2026-120436: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbgdecmergeplanes overflows th...

RHEL 8 : freerdp (RHSA-2026:93538)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93538 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RHEL 8 : freerdp (RHSA-2026:93549)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93549 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RHEL 9 : postgresql:16 (RHSA-2026:93460)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:93460 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: pgvector: pgvector: Arbitrary code execution via...

Rocky Linux 8 [CIQ] Security Update: python-pillow-debuginfo / python-pillow-debugsource / etc Multiple Vulnerabilities (crlsa-2026_93077)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693077 advisory. pillow: Pillow: Heap buffer overflow in tiffWriteProc when saving TIFF to BytesIO CVE-2026-112393 pillow: Pillow: Heap buffer overflow in FlashPix FPX JPE...

RHEL 10 : perl-HTTP-Daemon (RHSA-2026:93585)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93585 advisory. The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 server...

PT-2026-135449

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

PT-2026-135718

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description A use-after-free memory safety issue exists in multiple locations. This flaw allows for remote code execution without requiring additional execution privileges or user interaction...

PT-2026-135809

Dell Alienware Command Center AWCC, versions prior to 6.14.54.0, contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary Code Execution and Denial of Service...

RHEL 8 : perl-YAML:1.24 (RHSA-2026:93471)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:93471 advisory. he perl-YAML package provides the pure-Perl implementation of the YAML YAML Ain't Markup Language data serialization standard. It allows...

PT-2026-135405

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option...

PT-2026-135547

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

CVE-2026-73695: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in…

Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...