PT-2026-3251

Name of the Vulnerable Software and Affected Versions ConnectWise PSA versions prior to 2026.1 Description ConnectWise PSA versions older than 2026.1 may allow stored script code to execute in a user’s browser. This occurs because Time Entry notes stored in the Time Entry Audit Trail are rendered...

MiracleLinux 3 : autofs-5.0.1-0.rc2.177.0.1.AXS3 (AXSA:2013-77:01)

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2013-77:01 advisory. autofs is a daemon which automatically mounts filesystems when you use them, and unmounts them later when you are not using them. This can include network...

EUVD-2026-2905

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting XSS allows remote attackers to inject arbitrary web script or HTML into the login page via the tab parameter, for Choice authentication...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000857)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000857 advisory. The parserockridgeinodeinternal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service unkillable mount proce...

CVE-2026-0695: Improper Neutralization of Input During Web Page Generation

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected...

CGA-99CP-5FRP-PGCR

Bulletin has no description...

CVE-2025-71084

In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancelworksync will prevent the work from running which also prevents destroying the...

OSV-2026-57 Heap-buffer-overflow in mkv::matroska_segment_c::TrackInit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=475261418 Crash type: Heap-buffer-overflow READ 1 Crash state: mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::TrackInit mkv::matroskasegmentc::ParseTrackEntry...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002833)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002833 advisory. The getrockridgefilename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM aka alternate name entries containing \0 characters, which allows...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002365)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002365 advisory. The pmdnoneortranshugeorclearbad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not properly determine whether a Page...

Number withdrawal

“ring” is a library developed by Brian Smith as an individual contributor. This CVE number has been withdrawn...

Number withdrawal

“ring” is a library developed by Brian Smith as an individual contributor. This CVE number has been withdrawn...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002325 advisory. An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2clearrgrpd and readrindexentry. Tenable has...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002394)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002394 advisory. arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the...

Number withdrawal

“ring” is a library developed by Brian Smith as an individual contributor. This CVE number has been withdrawn...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001776)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001776 advisory. Buffer overflow in virt/kvm/irqcomm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service crash and possibly execu...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002195)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002195 advisory. Buffer overflow in virt/kvm/irqcomm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service crash and possibly execu...

EUVD-2026-2455

Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection attacks. Successful exploitation could allow an attacker to execute arbitrary SQL commands on the underlying database, potentially leading...

CVE-2025-71114

CVE-2025-71114 relates to the VIA watchdog driver in the Linux kernel. The driver uses allocate_resource() to reserve a MMIO region for the watchdog control register, but the resource lacked a name, causing the kernel resource tree to contain a entry under /proc/iomem on x86. During boot, this u...

CVE-2025-71114 via_wdt: fix critical boot hang due to unnamed resource allocation

In the Linux kernel, the following vulnerability has been resolved: viawdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses allocateresource to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a name, whi...