Linux Distros Unpatched Vulnerability : CVE-2026-98268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - perf: Fix null pointer access in isincludeguestevent A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu...

PT-2026-107967

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A...

CVE-2026-107737: Improper Validation of Array Index

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107733: NULL Pointer Dereference

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand handles CmdExec by passing a null current-tab pointer to RunWithExe, which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal t...

CVE-2026-107778: NULL Pointer Dereference

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

CVE-2026-107708: NULL Pointer Dereference

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

CVE-2026-16165: NULL Pointer Dereference

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference...

CVE-2026-107613: NULL Pointer Dereference

A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties for...

PT-2026-107939

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description A NUL...

CVE-2026-16182: NULL Pointer Dereference

IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing...

PT-2026-108183

The Affinity by Canva app before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an...

PT-2026-108201

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 krb5 versions prior to 1.22.3 Description A NULL pointer dereference occurs in the make cred list function within rd cred.c. Authenticated Kerberos clients can trigger this by sending mismatched KRB-CRED arrays. Specifically, an...

EulerOS 2.0 SP15 : patch (EulerOS-SA-2026-3998)

According to the versions of the patch packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU patch is vulnerable to a NULL pointer dereference when processing a specially crafted unified-diff patch file. Improper handling of consecutive...

EulerOS 2.0 SP15 : haproxy (EulerOS-SA-2026-3980)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buff...

Linux Distros Unpatched Vulnerability : CVE-2026-98243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch...

EulerOS 2.0 SP15 : libusbx (EulerOS-SA-2026-3923)

According to the versions of the libusbx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libusb before version 1.0.30 contains a NULL pointer dereference vulnerability that allows attackers to crash applications by supplying a malform...

PT-2026-108305

Name of the Vulnerable Software and Affected Versions SumatraPDF versions 3.6.1 and earlier SumatraPDF version 3.7.0.20369 Description When WebView2 is absent or fails to initialize, the ParseProtoUrl function accepts the signed host component of an its:// URL, which is then used by the...

PT-2026-108200

Name of the Vulnerable Software and Affected Versions MIT krb5 versions prior to 1.22.3 Description A NULL pointer dereference occurs in the KDC's get pac princ with realm function when it processes malformed names, returning success while leaving the client principal as NULL. A malicious or...

SUSE SLES16: libIex-3_2-31 / libIex-3_2-31-x86-64-v3 / libIlmThread-3_2-31 / etc (SUSE-SU-2026:24012-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24012-1 advisory. This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute parsing path when a...

PT-2026-108166

The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document tha...