PT-2026-90281

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect md mode when metadata dst allocation fails In collect md mode ipip tunnel rcv returns 0 without freeing the skb when ip tun rx dst fails to allocate the metadata dst. ipip rcv and mplsip rcv are...

PT-2026-89912

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser. Attacker...

PT-2026-90257

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss unwrap resp priv length checks gss unwrap resp priv validates the RPCSEC GSS opaque length with offset = u8 p - u8 head-iov base; if offset + opaque len rcv buf-len goto unwrap failed; maj stat = gss unwrapctx-...

PT-2026-90108

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

PT-2026-90344

In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd debug eeprom read trusts resp-raw data2 -- a length byte supplied by the device in its REPORT EE DATA reply -- clamped only to the caller's read count: re...

PT-2026-90076

In the Linux kernel, the following vulnerability has been resolved: fuse: copy request headers via a stack buffer for io-uring The fuse-io-uring transport copies req-in.h out to the ring in fuse uring copy to ring and req-out.h back in fuse uring commit. Both headers live inside the fuse request...

openSUSE 16: kpartx / libdmmp-devel / libdmmp0_2_0 / libmpath0 / multipath-tools / etc (openSUSE-SU-2026:21802-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21802-1 advisory. - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in device-mapper-multipath failedwwids management...

Oracle Linux 8 : ELSA-2026-66325-0: / kernel (ELSA-2026-663250)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663250 advisory. - tipc: fix slab-use-after-free Read in tipcaeaddecryptdone Xin Long RHEL-228877 CVE-2026-63801 - tipc: clear sock-sk on the failed-insert path in...

PT-2026-90349

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce t2 coalesce t2 computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data area of tgt = char...

PT-2026-90426

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: fix layout segment leak on the pnfs layout process forget path When the server returns a new layout stateid while a valid one is still held, pnfs layout process calls pnfs mark matching lsegs return on the on-stack free ...

Ivanti Endpoint Manager Mobile < 12.8.0.4 / 12.9.x < 12.9.0.2 / 12.10.0.0 Privilege Escalation (CVE-2026-18851)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.8.0.4, or 12.9.x prior to 12.9.0.2. It is, therefore, affected by a privilege escalation vulnerability: - Missing authorization in Ivanti Endpoint Manager Mobile before version...

Linux Distros Unpatched Vulnerability : CVE-2026-88021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not...

RockyLinux 8 : kernel-rt (RLSA-2026:66324)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66324 advisory. kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset CVE-2025-68745 kernel: scsi: target:...

Fedora 45 : baresip / libre (2026-c70f6e6ebc)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c70f6e6ebc advisory. Baresip v4.11.0 2026-08-25 - core: cleanup streamrtph ignore handling - audio: increase RTP timestamp also for underruns - aubuf: remove adaptive mode -...

PT-2026-90500

GitLab released security patches 19.3.2, 19.2.6, and 19.1.8 addressing vulnerabilities across Community Edition and Enterprise Edition. - The most severe flaws include unauthenticated arbitrary file disclosure CVE-2026-85706, authenticated credential and configuration exposure through GraphQL...

Linux Distros Unpatched Vulnerability : CVE-2026-88013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attache...

Linux Distros Unpatched Vulnerability : CVE-2026-88038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name a...

Apache Impala 4.5.1 Insufficient Authorization Remote Code Execution

Summary Apache Impala is a modern, open source, distributed SQL query engine for open data and table formats. Description Apache Impala versions 2.7.0 through 4.5.1 suffer from an insufficient authorization vulnerability that leads to remote code execution. A table created with STORED BY JDBC tak...

JFrog Artifactory Incorrect Authorization Vulnerability

JFrog Artifactory contains an incorrect authorization vulnerability that allows leads to privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope...

PT-2026-90289

In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array block check can only compare the header against itself, so a block with value size 4 and max entries 1018 is internally consistent and passes. dm-cache...