RockyLinux 10 : buildah (RLSA-2026:88262)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88262 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

MiracleLinux 8 : python3-3.6.8-79.el8_10.ML.1 (AXSA:2026-2123:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2123:11 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verificatio...

Linux Distros Unpatched Vulnerability : CVE-2026-113719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package...

Linux Distros Unpatched Vulnerability : CVE-2025-60492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack overflow in the gfbifsdecnode function /bifs/fielddecode.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via...

Linux Distros Unpatched Vulnerability : CVE-2026-114098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop that allows attackers to write arbitrary files outside the worktree...

Linux Distros Unpatched Vulnerability : CVE-2026-115504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for...

Linux Distros Unpatched Vulnerability : CVE-2026-113681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the...

Part-DB arbitrary file upload vulnerability

Versions prior to Part-DB 2.12.3 contain a security vulnerability. This vulnerability arises because SVG files are processed solely based on user-controlled file extensions rather than their actual content type. Attackers can upload malicious SVG files containing JavaScript payloads to bypass thi...

Kitodo.Production input validation error vulnerability

Versions prior to Kitodo.Production 3.9.2 contain an input validation error vulnerability. This vulnerability arises because XML parsing helper methods use default insecure configurations to build JAXP parsers, without disabling DOCTYPE declarations or external entity resolution. As a result, the...

Mervin Praison PraisonAI information disclosure vulnerability

Versions Mervin Praison PraisonAI from 3.8.1 up to 4.6.59 contain a security vulnerability. This vulnerability arises because the Dynamic Context Discovery feature exposes the artifact helper via ctx.gettools, without verifying whether artifactpath points to an artifact created within the...

Ancorathemes Your Dress code injection vulnerability

Ancorathemes: Versions 1.4.1 and earlier of Your Dress contain a code injection vulnerability. This vulnerability stems from improper control over filenames in Include/Require statements within PHP, potentially leading to local file inclusion...

PT-2026-121833

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIR BACKUP without calling...

PT-2026-121836

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

PT-2026-122443

Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...

PT-2026-135866

ANT-2026-6W9NPC2Q mmap dimension product integer overflow Fix Use caml umul overflow instead of when multiplying bigarray dimensions, which detects integer overflows and raise Failure. Negative positions are also rejected by raising Invalid argument. Am I affected? If either the dimensions or the...

Mervin Praison PraisonAI permission and access control issue vulnerability

Versions 4.5.110 through 4.6.61 of Mervin Praison PraisonAI contain a security vulnerability. This vulnerability arises because SandlockSandbox fails to shut down upon encountering Landlock; instead, it reverts to SubprocessSandbox. As a result, file systems and network boundaries are not enforce...

PT-2026-122244

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...

Linux Distros Unpatched Vulnerability : CVE-2025-55640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a...

Diego Nehab rply input validation error vulnerability

Diego Nehab: Versions 1.1.4 and earlier contain an input validation error vulnerability. This flaw stems from improper array index validation in the plyreadheaderproperty function; it accepts a list as the length or value type for list properties. An attacker can supply a specially crafted PLY...

Fallow path traversal vulnerability

A security vulnerability exists in Fallow versions from 2.68.0 up to but not including 3.34.0. This vulnerability stems from Fallow’s improper handling of project paths for the Jest and Vitest projects. Attackers can exploit this by using absolute paths, parent directory fragments, dot-prefixed...