PT-2026-120699

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

oretnom23 file-management-system-php input validation error vulnerability

The oretnom23 file-management-system-php versions 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ID parameter by the readfile function in the download.php file of the File Download component, potentiall...

Atlassian Confluence < 9.2.5 (CONFSERVER-104458)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104458 advisory. - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so a...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4589-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4589-1 advisory. - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. -...

Linux Distros Unpatched Vulnerability : CVE-2026-109277

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use...

AlmaLinux 8 : python3 (ALSA-2026:85239)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

Linux Distros Unpatched Vulnerability : CVE-2026-109741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird...

Wireshark 1.12.x < 1.12.4 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.4 advisory. - Integer overflow in the dissectosd2cdbcontinuation function in epan/dissectors/packet-scsi-osd.c in t...

Linux Distros Unpatched Vulnerability : CVE-2026-112202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With gifconsolidate = 1, palette indices from the imag...

PT-2026-120162

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

Linux Distros Unpatched Vulnerability : CVE-2026-109574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through...

RHEL 10 : lrzsz (RHSA-2026:86056)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86056 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

PT-2026-120720

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The explo...

Fedora 44 : gnome-shell-extension-gsconnect (2026-37da8aa1f8)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-37da8aa1f8 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

PT-2026-120629

A heap use-after-free in the gf filter pid send event downstream function /filter core/filter pid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Linux Distros Unpatched Vulnerability : CVE-2026-109247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenate...

SUSE CVE-2026-98777

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

SUSE CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

SUSE CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...