Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143033)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143033 advisory. In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after...

Bytecode Alliance wasmtime input validation error vulnerability

The Bytecode Alliance WasmTime versions prior to 46.0.0 through 48.0.4 and 49.0.0 through 49.0.2 contain an input validation error vulnerability. This vulnerability arises because the Wasi: HTTP implementation allows a guest to set the “between-bytes-timeout” request option to 0 and then directly...

PT-2026-120938

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.58 Traefik versions prior to 3.7.13 Description An authentication bypass exists that allows unauthenticated clients to skip client-certificate checks. This occurs because negated Host matchers are counted as serv...

PT-2026-121664

A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name...

PT-2026-121562

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write 16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions ...

Linux Distros Unpatched Vulnerability : CVE-2026-94140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote...

PT-2026-121334

webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in version 6.0.0, the unauthenticated open-editor endpoint validates the Host header with a regular expression meant for browser Origin schemes, so a Host value...

PT-2026-121333

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.7 webpack-dev-server version 6.0.0 Description When a proxy entry is configured to forward WebSockets, the server forwards non-HMR Hot Module Replacement WebSocket upgrade requests to the proxy target...

PT-2026-121512

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB SELF HOST endpoint. Attackers can set instanceUrl...

Linux Distros Unpatched Vulnerability : CVE-2026-114732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in...

PT-2026-121594

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description An authentication bypass in the SSH daemon allows an unauthenticated remote attacker to circumvent authentication controls. This can lead to the attacker gaining administrative privileges and...

CLSA-2026-1792623317 emacs: Fix of CVE-2026-79992

CVE-2026-79992: restrict Tramp user and host names...

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94423

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

UBUNTU-CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...

CVE-2026-94423

The Net::LibSSH Perl binding for versions before 0.004 is vulnerable to authentication bypass because the connect function fails to verify the host key against known_hosts. While the underlying libssh library leaves host key verification to the application, this specific binding fails to implemen...

CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts

Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against knownhosts. connect reports success as soon as sshconnect returns SSHOK. libssh leaves the known-hosts check to the application, and this binding never makes it, so th...

CVE-2026-94140

Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every remote branch of sync builds its ssh command with that option, for password authentication, for private-key authentication and for the fallback. Th...