PT-2026-95060

Name of the Vulnerable Software and Affected Versions lxc-ci Arch Linux images published prior to 2026-05-28 Description Images built from images/archlinux.yaml contain a shared pacman local-signing private key located in /etc/pacman.d/gnupg, which is redistributed to all containers or virtual...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

CVE-2026-19477: Stack-based Buffer Overflow

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux uldaq. This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux uldaq v1.2.1 and prior versions...

PT-2026-95059

Name of the Vulnerable Software and Affected Versions MCC Universal Library for Linux uldaq versions prior to 1.2.1 Description A stack-based buffer overflow exists in the library, which can lead to arbitrary code execution or information disclosure. A stack-based buffer overflow occurs when a...

CVE-2026-93375: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

PT-2026-95095

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description The validation test harness allows the deserialization of tracked pickle cache files via the pickle.load method within the read pickle data function located in tests/pickle...

RockyLinux 9 : libevent (RLSA-2026:67910)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67910 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

PT-2026-95115

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description A use after free issue exists within the Extensions component. This flaw allows a remote attacker to execute arbitrary code outside the sandbox by utilizing a specially crafted Chrome...

PT-2026-95116

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 153.0.8010.52 Description A use after free issue in Dawn allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after...

PT-2026-95123

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.52 Description A buffer overflow exists in PDFium, a PDF rendering engine, within Google Chrome on Windows. A remote attacker could use social engineering to trick a user into opening a specially...

PT-2026-105521

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27g9-p43v-cw3v. This link is maintained to preserve external references. Original Description vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.final...

CVE-2026-54916: Uncontrolled Search Path Element

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-45140: Improper Limitation of a Pathname to a Restricted Directory

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

Check Point Security Gateway Firewall Code Execution

The vulnerability of Check Point Security Gateway and Check Point Spark Firewall is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

AlmaLinux 9 : postgresql:16 (ALSA-2026:67491)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67491 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrar...

AlmaLinux 10 : postgresql18 (ALSA-2026:67280)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67280 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

AlmaLinux 9 : postgresql:18 (ALSA-2026:67848)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67848 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

PT-2026-105516

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxxv-8r27-vm4p. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary...

PT-2026-94740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists when reading bpf link information. In the functions bpf link show fdinfo and bpf link get info by fd, the link-prog variable is accessed without proper...

CVE-2026-92950: Insecure Default Variable Initialization

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...