SUSE CVE-2026-74580

In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok returns early on a cache hit, taking the hit as proof that the region h...

Linux Distros Unpatched Vulnerability : CVE-2026-74676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vt: add permission check for KDSKBMETA ioctl KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all other keyboard setter ioctls in vtkioctl...

Linux Distros Unpatched Vulnerability : CVE-2026-74580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost: reset the vring metadata cache on vring reconfiguration vq-metaiotlb caches the vhostiotlbmap that backs each vring metadata region, and iotlbaccessok...

PT-2026-79579

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description The form.inlineedit form controller fails to perform necessary access checks, which allows unauthenticated users to disclose rows of data. Recommendations Update to version 4.7.2 or later...

Linux Distros Unpatched Vulnerability : CVE-2026-74641

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: usx2y: bound the hwdep mmap fault offset sndus428ctlsvmfault turns the faulting page offset into a kernel address with no bound of any kind: offset =...

Linux Distros Unpatched Vulnerability : CVE-2026-74733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to...

PT-2026-79646

In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: bound the hwdep mmap fault offset snd us428ctls vm fault turns the faulting page offset into a kernel address with no bound of any kind: offset = vmf-pgoff us428ctls sharedmem + offset; page = virt to pagevaddr; get...

PT-2026-79602

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: clear skb2-cb in ip6ip6 err ip6ip6 err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6 send. The clone still carries the outer packet's inet6 skb parm...

PT-2026-79652

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the fastrpc req munmap impl function. The issue occurs because buffers are removed from the list only after they are unmapped from the DSP. When multiple threa...

PT-2026-79518

Name of the Vulnerable Software and Affected Versions SmilePass Selfie Login versions prior to 1.0.3 Description The SmilePass Selfie Login WordPress plugin fails to perform server-side verification of the identity during the authentication process. This flaw allows unauthenticated users to bypas...

PT-2026-79583

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.3 Description The download element in the Fabrik extension for Joomla lacks a proper Access Control List ACL check. An ACL is a security mechanism that regulates which users or system processes are granted access t...

Linux Distros Unpatched Vulnerability : CVE-2026-74647

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - misc: fastrpc: Remove buffer from list prior to unmap operation fastrpcreqmunmapimpl is called to unmap any buffer. The buffer is getting removed from the list...

Linux Distros Unpatched Vulnerability : CVE-2026-74597

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to...

Linux Distros Unpatched Vulnerability : CVE-2026-74608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If...

CVE-2026-48050

Arc is an open, SQL-native time-series database for telemetry. Versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/ via app.Usepprof.New in internal/api/server.go, and /debug/pprof is added to PublicPrefixes in cmd/arc/main.go. The auth middleware short-circuits before...

CVE-2026-49360

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-34948

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, only classes present in the SELECT clause are protected by the silos access check in OQL. This issue has been fixed in version 3.2.3...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-49360

Recce (a data-validation toolkit for dbt PR review) versions prior to 1.50.0 are vulnerable to unauthenticated SQL execution through the query run API when deployed with a DuckDB-backed project and exposed to an untrusted network without authentication. An attacker can leverage DuckDB filesystem ...