RLSA-2026:22121 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum validation flaw via malicious module proxy...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

go-toolset:rhel8 security update

An update is available for golang, module.golang, module.delve, delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming...

CVE-2026-75333

yx-image-recognition v1.0 contains a Path Traversal vulnerability where parameters such as dir and filePath are passed directly to new File() for file system operations without any path sanitization or whitelist validation. The CVSS 3.1 score is 7.5 (High) , reflecting a network vector with no pr...

PT-2026-82044

Name of the Vulnerable Software and Affected Versions TeamViewer Desktop Clients versions prior to 15.81.5 Description Improper neutralization of path traversal sequences allows an authenticated remote session participant to write files to unintended locations on the local file system. This occur...

Ubuntu 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS : Linux kernel vulnerabilities (USN-8661-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / Pro Realtime 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8661-1 advisory. Siebe Devroe, Hlose Gollier, and Mathy Vanhoef discovered that the WiFi implementation in the Linux kernel did not...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-75413

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...

CVE-2026-75327

DocSys-master V2.02.85 contains an arbitrary file upload vulnerability in the uploadMarkdownPic interface located at src/com/DocSystem/controller/DocController.java. The flaw is remotely exploitable with low complexity , requires no privileges or user interaction, and carries a CVSS 3.1 score of ...

EUVD-2026-66662

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...

CVE-2026-36851

UnPoller v2.33.0 contains a path traversal vulnerability in its password field. In pkg/inputunifi/input.go, any value prefixed with file:// is passed to os.ReadFile() without path validation, allowing an attacker with write access to the up.conf file to specify any readable file on the system. Th...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

PT-2026-82212

Name of the Vulnerable Software and Affected Versions FiftyOne affected versions not specified Description The application renders a dataset field's description as markup without proper sanitization or escaping. Specifically, the sidebar field-information component located at...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

Linux Distros Unpatched Vulnerability : CVE-2026-79151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tcl (UTSA-2026-054029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054029 advisory. In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of th...

Linux Distros Unpatched Vulnerability : CVE-2026-80101

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-bad-free (UTSA-2026-104837)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104837 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of th...

Linux Distros Unpatched Vulnerability : CVE-2026-79207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file...

Linux Distros Unpatched Vulnerability : CVE-2026-79223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. Chromium...