Linux Distros Unpatched Vulnerability : CVE-2026-71196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - glance - None Ubuntu Linux - Unknown description CVE-2026-71196 Note that Nessus relies on the presence of the package as reported by the vendor...

CVE-2026-85150

A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...

Linux Distros Unpatched Vulnerability : CVE-2026-84968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a...

Linux Distros Unpatched Vulnerability : CVE-2026-80799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops:...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: cups-filters (UTSA-2026-106457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106457 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the...

PT-2026-85405

The ACPT Premium plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the submit function, which allows unauthenticated form submissions to control the target user ID before calling wp update user. This...

CVE-2026-84969

A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a binary field is encoded and the output is cut short at a caller-configured length limit. A party who supplies the document content, with no...

PT-2026-85691

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

CVE-2026-79419

A reflected cross-site scripting (XSS) vulnerability affects EMX Tecnologia Gestao X Business Suite 8.4 and earlier , caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint. An attacker can inject arbitrary JavaScript that executes ...

EUVD-2021-34874

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight...

PT-2026-85464

Name of the Vulnerable Software and Affected Versions AI Website Builder WordPress plugin GitHub build version 1.0.0 Description Lack of authorization and nonce checks on REST API routes allows unauthenticated attackers to perform several unauthorized actions. These include installing and...

CVE-2026-79390

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...

EUVD-2026-71456

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106166)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106166 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106171 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server:...

Linux Distros Unpatched Vulnerability : CVE-2026-80798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: reject PDUs shorter than the LLCP header Every LLCP PDU begins with a two-byte header DSAP/SSAP + PTYPE, but the receive path never checked that a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106208)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106208 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL...

Linux Distros Unpatched Vulnerability : CVE-2026-19534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cockpit (UTSA-2026-106156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106156 advisory. A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowi...