RockyLinux 8 : flatpak (RLSA-2026:89859)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89859 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary...

Asterisk permission and access control issue vulnerability

Versions prior to Asterisk 20.20.1, from 21.0.0-pre1 up to versions prior to 21.12.3, from 22.0.0-pre1 up to versions prior to 22.10.1, and from 23.0.0-pre1 up to versions prior to 23.4.1, as well as Certified Asterisk versions prior to 20.7-cert11 and from 22.8-cert1-pre1 up to 22.8-cert3, are...

World Wide Broadcast Network AVideo path traversal vulnerability

Versions prior to AVideo 29.5.0 of the World Wide Broadcast Network contain a path traversal vulnerability stemming from local file inclusion issues. Unauthenticated attackers can exploit this by including PHP files outside the locale directory via a specially crafted Accept-Language header, then...

CVE-2026-58257: JeromeDevome GRR: GRR is a resource management and reservation application

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-48380: Out-of-bounds Read

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious...

PT-2026-127223

Name of the Vulnerable Software and Affected Versions MLflow versions 3.10.0 through 3.16.1 Description An issue exists where a remote caller can read arbitrary files from the server filesystem with the privileges of the server process. This occurs because the prompt branch in the create model...

CVE-2026-108325: Insertion of Sensitive Information into Log File

Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation...

Mozilla Firefox security vulnerabilities

A security vulnerability exists in Mozilla Firefox versions prior to 159 and Mozilla Thunderbird versions prior to 159. This vulnerability stems from a race condition and use-after-free issue in the DOM: File component...

Model Context Protocol MCP Python SDK server request forgery vulnerability

Versions 1.10.0 through 1.30.0 and 2.0.0 through 2.2.0 of the Model Context Protocol MCP Python SDK contain a server-side request forgery vulnerability. This vulnerability arises because ClientSession, ClientSessionGroup, and Client invoke the default JSON schema parser to validate the outputSche...

YesWiki server request forgery vulnerability

Versions prior to YesWiki 4.7.0 contain a server-side request forgery vulnerability. This flaw stems from server-side request forgery in DuplicationManager::downloadFile, allowing authenticated administrators to submit arbitrary outbound requests via the file array to /api/pages/tag/duplicate usi...

Autodesk Fusion cross-site scripting vulnerability

Autodesk Fusion versions 2705.1.30 through 2706.1.14 contain a cross-site scripting vulnerability. This vulnerability arises when a specially crafted HTML payload within the design name is displayed after another user opens the design; it triggers a stored cross-site scripting flaw, potentially...

CVE-2026-116840

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

PT-2026-127254

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-116686: Server-Side Request Forgery (SSRF)

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

RockyLinux 9 : python3.9 (RLSA-2026:89742)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89742 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

Linux Distros Unpatched Vulnerability : CVE-2026-115377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write...

CentOS Linux 8.5 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.5:CLSA-2026:1793098886)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793098886 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination...

RockyLinux 9 : flatpak (RLSA-2026:89850)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89850 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-116261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afcfileopen of the file src/afc.c of the component AFC File...

Oracle Linux 9 : buildah (ELSA-2026-90424)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-90424 advisory. - Rebuild for CVE-2026-78667 and CVE-2026-111943 - Update to buildah 1.43.4 c7061d00 - fix CVE-2026-56855 golang.org/x/crypto/ssh DoS and CVE-2025-113...