Linux Distros Unpatched Vulnerability : CVE-2026-101201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malformed header in the binary file fed to QBinaryJson::fromBinaryData can cause undefined behaviour because of out-of-bounds read. CVE-2026-101201 Note that...

Ubuntu: USN-8927-1 (CVE-2026-107928): curl vulnerabilities

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...

PT-2026-117955

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user id HTTP header. Attackers can set user id to another tenant's ID, even with LETTA SERVER SECURE enabled, to read and modify that user's agents,...

PT-2026-119064

Vulnerability in Oracle REST Data Services component: Database Actions. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this...

PT-2026-120074

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Majel Mobile Service. Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

Oracle E-Business Suite: CVE-2026-83388: Critical Patch Update

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite component: Diagnostics. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-53149)

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Bound root directory content to block size tbpropertyparsedir does not check that contentoffset + contentlen fits within blocklen for the root directory case. When rootdir-length equals or exceeds blocklen - 2, the...

Google Chrome Vulnerability: CVE-2026-113050

Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

Apache Tomcat 11.0.0.M25 < 11.0.27 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.27. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.27security-11 advisory. - A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was...

PT-2026-118906

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 156.0.8078.47 Description Memory corruption in the Navigation component allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-119060

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

MiracleLinux 9 : kernel-5.14.0-687.45.1.el9_8 (AXSA:2026-2001:95)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2001:95 advisory. kernel: can: bcm: add locking for bcmop runtime updates CVE-2025-38004 kernel: iouring/poll: fix signed comparison in iopollgetownership...

PT-2026-119610

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 21.0.12.1 through 21.0.12.1 Oracle Java SE versions 25.0.4.1 through 25.0.4.1 Oracle Java SE version 27 Description A flaw in the Networking component allows an unauthenticated attacker with network access via multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-112896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size...

RockyLinux 10 : openexr (RLSA-2026:84796)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:84796 advisory. OpenEXR: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-34544 OpenEXR: OpenEXR: Out-of-bounds write...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791386404)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791386404 advisory. - rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destinatio...

PT-2026-118387

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

PT-2026-119781

Vulnerability in the Oracle Solaris product of Oracle Systems component: Libraries. The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successf...

PT-2026-117990

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination...

Oracle E-Business Suite: CVE-2026-101814: Critical Patch Update

Vulnerability in the Oracle Engineering product of Oracle E-Business Suite component: Change Management. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering...