PT-2026-64501

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists where afu ioctl dma map accepts a 64-bit length from userspace via the DFL FPGA PORT DMA MAP ioctl without an upper bound check. This value is passed to afu dma pin pages...

Linux Distros Unpatched Vulnerability : CVE-2026-64273

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: iforce - bound the device-reported force-feedback effect index iforceprocesspacket handles a status report packet id 0x02 by taking a force-feedback effe...

Linux Distros Unpatched Vulnerability : CVE-2026-56391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU coreutils uniq is vulnerable to an outofbounds read due to incorrect handling of multibyte input when the -w --check-chars option is used. The findfield...

PT-2026-64699

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: avoid kobject path lookup in DualSense match The DualSense jack-detection input handler verifies that a matching input device belongs to the same physical controller by building kobject path strings for both the...

PT-2026-64494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read-modify-write issue exists in the iforce process packet function when handling status reports packet id 0x02. The function uses a force-feedback effect index obtaine...

PT-2026-64560

In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbio bulk msg copies bpkt len = le16 to cpubpkt-len bytes out of the bulk IN buffer usbio-rxbuf, allocated with size usbio-rxbuf len into the caller's...

PT-2026-64713

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm iio trigger register tmp006 probe allocates the DRDY trigger with devm iio trigger alloc but registers it with plain iio trigger register. The driver has no .remove callback, so on module unload...

KLA91172 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Input can be exploited remotely to execute...

Linux Distros Unpatched Vulnerability : CVE-2026-64271

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: touchwin - reset the packet index on every complete packet twinterrupt accumulates each non-zero serial byte into a fixed three-byte buffer with a runnin...

Linux Distros Unpatched Vulnerability : CVE-2026-56852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Note that Nessus relies on the presence of the package...

PT-2026-64760

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device qat adf ctl with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any publi...

PT-2026-64497

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the synaptics-rmi4 driver where the rmi f30 map gpios function allocates the gpioled key map with a maximum of 6 entries. However, the rmi f30 attention function...

Linux Distros Unpatched Vulnerability : CVE-2026-47143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in modRMRequired and decode when disassembling...

PT-2026-64538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the isofs component when handling Rock Ridge symbolic link SL records. The functions get symlink chunk and parse rock ridge inode internal process...

GHSA-J6G5-3HH3-PGW8 AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Summary The AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

PYSEC-2026-3657

NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the main block passes command-line...

GHSA-QW6M-8FW2-2V64 Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution

Summary Budibase's MongoDB query execution endpoint POST /api/v2/queries/:queryId is vulnerable to NoSQL injection through user-supplied query parameters. The enrichContext function interpolates parameter values into JSON query templates using Handlebars with noEscaping: true, then parses the...

GHSA-GF8H-GQ53-288J OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

UBUNTU-CVE-2026-66037

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying a crafted countlabel field. The mixpresentationob...