Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143048)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143048 advisory. In the Linux kernel, the following vulnerability has been resolved: module: fix eshstrndx.shsize=0 OOB access It is trivial to craft a module to trigger OOB access i...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142693)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142693 advisory. In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142559)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142559 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: rmi: fix OOB access with undersized RMI reports The hid-rmi driver sizes its...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142747)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142747 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: fix unaligned memory access in timestamp adjustment Use getunalignedbe32 and...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142739 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segmentsleft AH6 rearranges routing-header addresses before...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143058)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143058 advisory. In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the...

Linux Distros Unpatched Vulnerability : CVE-2026-101774

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Serve...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142476)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142476 advisory. In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer8 to locate the image...

WordPress SureDash authorization issue vulnerability

WordPress SureDash versions 1.12.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

Gitlab Gitlab: CVE-2026-14288: Use of Incorrectly-Resolved Name or Reference

GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request approval policy on a protected branch due to improper access...

OpenBao session mechanism vulnerability

Versions prior to OpenBao 2.6.4 and versions 2.7.x prior to 2.7.1 contain a session mechanism vulnerability. This vulnerability arises because, when renewing tokens issued by the Kubernetes Auth method, it fails to verify whether the originally used service account token remains valid. As a resul...

Smile Digital Health HAPI FHIR authorization issue vulnerability

Smile Digital Health HAPI FHIR has an authorization issue vulnerability stemming from improper access control. When REST-hook subscriptions are enabled, users with subscription creation privileges may query and read resources they are otherwise denied access to, resulting in unauthorized access...

ROS-20261022-73-0075

The vulnerability of the extension unit search mechanism for the UVC H.264 RDP client FreeRDP, related to memory reading beyond the allocated range, allows a perpetrator to access potentially confidential data...

ROS-20261022-73-0066

The vulnerability of the Portainer container management platform is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

ROS-20261022-73-0062

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ROS-20261022-73-0101

The vulnerability in Grafana is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20261022-73-0019

The vulnerability of the RDPDR IRP RDP-client FreeRDP module is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain access to read, write, and delete arbitrary files...

KiloView E3 Firmware Trust Management Vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain a trust management vulnerability. This vulnerability arises because the authentication framework uses a HMAC-SHA256 key hardcoded into the firmware image to sign session JSON Web Tokens. Since all deployed devices share this same key,...

PT-2026-121274

WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...

PT-2026-121411

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...