Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libssh2 (UTSA-2026-102685)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102685 advisory. libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftpopen function in src/sftp.c that allows a malicious SSH server to...

PT-2026-78418

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description Broken object level authorization BOLA exists in the quarantine review endpoints. In multi-tenant deployments using the stigmem-plugin-multi-tenant plugin, the get quarantined fact function i...

PT-2026-78698

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.13.0 Description An authenticated TURN user can introduce printf-style format specifiers into the STUN USERNAME or REALM attributes. These attributes bypass is secure string validation and are embedded into Redis key...

PT-2026-78526

Name of the Vulnerable Software and Affected Versions FFmpeg versions prior to commit 1c10bcc Description A heap buffer overflow exists in the RIST protocol reader within libavformat/librist.c. The function librist read fails to respect its size argument, copying the entire received payload lengt...

Linux Distros Unpatched Vulnerability : CVE-2026-68468

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mtd: virt-concat: free duplicate generated name Every MTD registration runs...

PT-2026-78543

Name of the Vulnerable Software and Affected Versions ISPConfig affected versions not specified Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casti...

ROS-20260819-73-0074

The vulnerability of the unserialize function in the MediaWiki software, which is used to implement the hypertext environment, is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Fedora 43 : perl-List-SomeUtils-XS (2026-6217093b91)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6217093b91 advisory. 0.59 - Fix a heap buffer overflow in the pairwise function when it would return a very large list - CVE-2026-12844 Tenable has extracted the preceding...

The vulnerability of the to_char(timestamptz) function in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the tochartimestamptz function in the PostgreSQL database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2026-72329

A flaw was found in the net/liquidio component of the Linux kernel. The Single Root I/O Virtualization SR-IOV enable path incorrectly cached Virtual Function VF pcidev pointers. This improper handling of references could lead to a use-after-free vulnerability when the cached pointer is later...

CVE-2026-72328

A flaw was found in the Linux kernel's accel/amdxdna component. A race condition exists where the aie2populaterange function can attempt to use an amdxdnaumap object that is simultaneously being released. This concurrent access may lead to a use-after-free vulnerability, which could result in...

CVE-2026-75976

TRENDnet TEW-823DRU router firmware 1.1.02b01 contains a stack-based buffer overflow in the strcpy call within /cgi-bin/wan.cgi (NVRAM component), triggered by the wan_l2tp_password argument. CVSS 9.9 (CRITICAL) reflects remote, unauthenticated-exploitable complete confidentiality/integrity/avail...

CVE-2026-75976 TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wanl2tppassword causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been ma...

CVE-2026-75976 TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wanl2tppassword causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been ma...

CVE-2025-11729

The WordPress PPWP plugin (≤1.9.15) has an improper capability check in its can_access function, allowing authenticated Contributors and above to retrieve the master password and bypass protection on any password-protected post or page. CVSS 4.3 (Medium). The plugin's changelog shows a fix was ap...

CVE-2025-11729 PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

Reliance on Untrusted Inputs in a Security Decision

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the getTrustProxyFn hop-count handling in lib/request.js when trustProxy is configured as a number. An attacker can overwrite...

CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

CVE-2026-72312

A flaw was found in the Linux kernel's octeontx2-af driver. A Virtual Function VF, which is a virtualized network interface, can inadvertently disable the promiscuous and all-multicast allmulti modes of the Physical Function PF network interface. This occurs because the underlying application...

CVE-2026-72304

A flaw was found in the Advanced Linux Sound Architecture ALSA System on Chip ASoC Sound Open Firmware SOF ipc4-control component of the Linux kernel. This Time-of-check to time-of-use TOCTOU vulnerability occurs in the sofipc4bytesput function, where the copy size is incorrectly derived from old...