CVE-2026-90503: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714. The affected element is the function sub11008 in the library ComputerZx64.sys. Executing a manipulation of the argument PhysicalAddress can lead to information disclosure. The attack needs to be launched locally. The exploi...

Linux Distros Unpatched Vulnerability : CVE-2026-90773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute...

PT-2026-90840

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

CVE-2026-90576: NULL Pointer Dereference

A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The explo...

CVE-2026-90773: Improper Neutralization of Escape, Meta, or Control Sequences

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...

PT-2026-90942

Name of the Vulnerable Software and Affected Versions GPAC versions prior to abi-16.23 Description A null pointer dereference occurs in the MP4Box component within the gf node list add child function located in the scenegraph/base scenegraph.c file. This issue can be triggered by a local attacker...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000378)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000378 advisory. Use After Free in GitHub repository vim/vim prior to 9.0.0490. Tenable has extracted the preceding description block directly from the Unity Linux security advisory...

CVE-2026-90485

A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub11838 of the file IURegistryFilter.sys of the component IOCTL Dispatch Handler. This manipulation causes null pointer dereference. The attack requires local access. The exploit has been published and m...

SUSE CVE-2026-80976

In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decapandvalidate pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet,...

SUSE CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

SUSE CVE-2026-89626

In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hidsensorcustomaddattributes creates one sysfs group for each custom sensor field. If sysfscreategroup fails after some groups have already been created, the function...

SUSE CVE-2026-89628

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcddebugeepromread trusts resp-rawdata2 -- a length byte supplied by the device in its REPORTEEDATA reply -- clamped only to the caller's read count: ret =...

dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

Fedora 43 : mingw-expat (2026-4a2ee61320)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4a2ee61320 advisory. Update to expat-2.8.4. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2026-80978

A flaw was found in the Linux kernel, specifically within its IP tunnel devices. A local attacker could create a stack of user-controlled IP tunnel devices, causing the system to miscalculate the required memory for network packet headers. This miscalculation can lead to unnecessary memory...

CVE-2026-89548

A flaw was found in the Linux kernel's SUNRPC component. When sunrpcdestroycachedetail is called, it may not properly drain the cachecleaner before freeing a cachedetail object. This oversight can lead to a use-after-free vulnerability, where the system attempts to access or use memory that has...

CVE-2026-89613

A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number VCN and size. A local attacker could potentially craft a malicious NTFS filesystem that,...

CVE-2026-89610

A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted mapping pairs array. This could lead to memory corruption and...

CVE-2026-89737

A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The tbtaltmoderemove function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-after-free vulnerability, where the system attempts to access...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...