PT-2026-102740

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

CVE-2026-95347: Use After Free

Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-15390: Out-of-bounds Write

Das U-Boot with CONFIGIPDEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit...

CVE-2026-102323: Access of Resource Using Incompatible Type

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Amazon Linux 2 : thunderbird (ALAS-2026-3960)

The version of thunderbird installed on the remote host is prior to 140.16.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3960 advisory. Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside th...

RockyLinux 10 : ipa (RLSA-2026:72279)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72279 advisory. ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Requests vulnerability (USN-8825-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8825-1 advisory. It was discovered that Requests did not correctly handle generating random temporary file paths. An attacker could possibly us...

RHEL 9 : vim (RHSA-2026:72465)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72465 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary Code Execution via crafted directo...

Ubuntu 24.04 LTS / 26.04 LTS : FreeRDP vulnerabilities (USN-8836-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8836-1 advisory. It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8827-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8827-1 advisory. It was discovered that the Erlang Port Mapper Daemon did not properly handle slow...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Atril vulnerabilities (USN-8839-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8839-1 advisory. It was discovered that Atril did not properly sanitize command-line arguments in PDF /GoToR actions. If a user...

PT-2026-102860

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the...

Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...

PT-2026-102855

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

PT-2026-102839

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A use after free issue exists in the Bluetooth component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

SUSE CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...

SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-98025

A flaw was found in the Linux kernel's cx82310eth USB Ethernet driver. An attacker connecting a malicious USB device can trigger a heap-based buffer overflow by sending crafted packets containing a reboot indicator. Because the driver fails to discard the packet after detecting the reboot signal,...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...