PT-2026-71818

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write...

Linux Distros Unpatched Vulnerability : CVE-2026-14677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-boun...

Vulnerability in core server (CVE-2026-14662)

PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may...

SUSE SLES15: himmelblau / himmelblau-sshd-config / himmelblau-sso / etc (SUSE-SU-2026:3576-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3576-1 advisory. Security fixes: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1...

PT-2026-71903

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

PT-2026-71759

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

PT-2026-71634

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

Autodesk Revit 2026 < 2026.5 / 2027 < 2027.2 Multiple Vulnerabilities (adsk-sa-2026-0011)

The version of Autodesk Revit installed on the remote host is 2026 prior to 2026.5 or 2027 prior to 2027.2. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted PDF file, when parsed through Autodesk Revit, can force a Use-After-Free vulnerability. A malicious actor can...

UBUNTU-CVE-2026-63293

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

PT-2026-71462

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These...

CVE-2026-63293

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

Linux Distros Unpatched Vulnerability : CVE-2026-63293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an...

CVE-2026-63796 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-63796 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68206 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68206 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68151 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68151 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68187 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68187 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64535 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-64535 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64428 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64428 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64405 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64405 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

GHSA-CXGV-HP74-JJ7R Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...