RHEL 9 : Satellite 6.17 (RHSA-2026:92859)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92859 advisory. openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924. openvox-agent: heap buffer overflow in C...

RHEL 9 : Satellite 6.18 (RHSA-2026:92860)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92860 advisory. openvox-agent: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-8924. openvox-agent: heap buffer overflow in C...

RHEL 9 : tomcat (RHSA-2026:92871)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92871 advisory. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages JSP technologies. Security Fixes: tomcat: Apache Tomcat:...

RHEL 10 : yggdrasil (RHSA-2026:91572)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:91572 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate chil...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:92622)

The remote Redhat Enterprise Linux 10 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:92622 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

RHEL 8 : pcre2 (RHSA-2026:92901)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92901 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern...

CVE-2026-104065: Scribus: Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…

Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing...

CVE-2026-62966: ESP32Async ESPAsyncWebServer: ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in src/WebRequest.cpp frees itemBuffer and sets it to NULL when BOUNDARYORDATA matches the closing boundary of a file part, before confirming...

PT-2026-133552

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into...

CVE-2026-119591: SQLite: SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to…

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization that allows attackers to crash the host process via count over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TKPLUS expressions who...

CVE-2026-119727: Red Hat: A flaw was found in GStreamer's gst-plugins-bad H.265 video parser

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding SCC extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accep...

PT-2026-133508

SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization that allows attackers to crash the host process via count over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK PLUS expressions...

CVE-2026-119728: Red Hat: A flaw was found in the H.264 video parser in gst-plugins-bad

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview MVC Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse...

CVE-2026-61626: libass: libass is a portable subtitle renderer for the ASS/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format

libass is a portable subtitle renderer for the ASS/SSA Advanced Substation Alpha/Substation Alpha subtitle format. From 0.17.4 until 0.17.5, libass event pruning does not guard negative Matroska ReadOrder values, allowing an attacker to clear arbitrarily many bits to zero at attacker-controlled...

EUVD-2026-114087

Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit...

PT-2026-133598

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agent data store/upload in backend/app/data store/data store routes.py permits customer user callers to choose bucket name and object name without an allowlist, tenan...

PT-2026-133570

An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...

PT-2026-133455

SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE LIMIT EXPR DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in a...

CVE-2026-119729: Red Hat: A flaw was found in GStreamer

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

Medium: libxml2

Issue Overview: A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a nextCatalog element lacks its mandatory catalog attribute, leading to the application crashing a...