Elastic Agent 8.19.13 < 8.19.22 / 9.2.7 <= 9.2.8 / 9.3.x <= 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-194)

The version of Elastic Agent / Elastic Endpoint installed on the remote Windows host is 8.19.13 through 8.19.21, or 9.2.7 through 9.2.8, or 9.3.x through 9.3.8, or 9.4.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a denial of service vulnerability as referenced in the...

AlmaLinux 9 : freerdp (ALSA-2026:76755)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:76755 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

Linux Distros Unpatched Vulnerability : CVE-2026-107678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in avencryptioninitinfofree in libavutil/encryptioninfo.c, which recursively frees...

Linux Distros Unpatched Vulnerability : CVE-2026-107634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in getdataset and getnextdatum that never validate dataset and datum sizes against the...

Linux Distros Unpatched Vulnerability : CVE-2026-107696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg through 9.0.2 contains an infinite loop vulnerability in ffrtspconnect in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit...

Linux Distros Unpatched Vulnerability : CVE-2026-107888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs when a job marked job-held-on-create refers to a temporary printer that ha...

Cisco NX-OS Software NX-API RCE (cisco-sa-napi-rce-r2shwu2j)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service DoS...

Rocky Linux 8 [CIQ] Security Update: compat-libpthread-nonshared / glibc / glibc-all-langpacks / etc Multiple Vulnerabilities (crlsa-2026_76777)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676777 advisory. glibc: Process abort due to invalid memory in wordexp CVE-2026-6368 glibc: Denial of Service via stack exhaustion during tilde expansion CVE-2026-6791...

EUVD-2026-95916

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format CPF handling logic. This allows a remote attacker to cause a denial of service...

PT-2026-109163

An Editor can set file-provisioning metadata the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, a...

Linux Distros Unpatched Vulnerability : CVE-2026-107635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dislocker through 0.7.3 contains an integer underflow vulnerability in getvmk and getfvek that allows attackers to trigger out-of-bounds heap reads via crafted...

openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236:...

PT-2026-108818

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The FIQL query parser contains a flaw in its operator search mechanism. When processing a long string that lacks an operator,...

Linux Distros Unpatched Vulnerability : CVE-2026-107655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an...

Cisco License (Smart Software Manager) On-Prem Multiple Vulnerabilities (cisco-sa-ssm-access-nttb2dhE)

According to its self-reported version, Cisco License On-Prem formerly Cisco Smart Software Manager On-Prem is affected by multiple vulnerabilities, including: - A vulnerability in the web-based management interface of Cisco License On-Prem could allow an unauthenticated, remote attacker to gain...

Linux Distros Unpatched Vulnerability : CVE-2026-78669

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS...

Linux Distros Unpatched Vulnerability : CVE-2026-61801

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The github.com/moby/sys/user package provides Go utilities for parsing and looking up entries in Unix- style user and group database files. Versions before 0.4....

CVE-2026-97032

A flaw was found in Go's net/http package. A remote attacker can cause a Denial of Service DoS by crashing the HTTP/2 server. Due to missing synchronization, the server concurrently modifies its HPACK HTTP/2 header compression encoder when encoding response headers while processing incoming table...

CVE-2026-105405

A flaw was found in ImageMagick. A remote attacker could exploit this vulnerability by supplying a specially crafted Magick Vector Graphics MVG image for processing. When parsed by the MVG decoder, the malformed input triggers an invalid memory free operation, crashing the application and causing...

CVE-2026-105827

A flaw was found in ImageMagick. A remote attacker can trigger a Denial of Service DoS by providing a specially crafted image file in the Continuous Acquisition and Life-cycle Support CALS format. Because the CALS decoder fails to properly limit recursion depth, processing the malicious image...