PT-2026-108183

The Affinity by Canva app before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an...

PT-2026-108167

Name of the Vulnerable Software and Affected Versions MongoDB PHP Driver affected versions not specified Description The BSON encoder converts a string length to a 32-bit value without proper validation. If an application encodes a string close to 4 GiB, the allocation size may wrap around while...

PT-2026-108009

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow...

PT-2026-107974

ImageMagick before 7.1.2-31 contains a heap buffer overflow vulnerability that allows attackers to overwrite heap memory by making a crafted call to the GetVirtualPixels API. Attackers can trigger the out-of-bounds heap write through crafted input to crash the server, causing a denial of service...

PT-2026-108011

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8893-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8893-1 advisory. It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2...

RockyLinux 9 : freerdp (RLSA-2026:76755)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76755 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

RHEL 9 : freerdp (RHSA-2026:76755)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76755 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_76747)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676747 advisory. FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command CVE-2026-91954 FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in...

EulerOS 2.0 SP15 : gzip (EulerOS-SA-2026-3913)

According to the versions of the gzip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the...

AlmaLinux 8 : kernel-rt (ALSA-2026:77500)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77500 advisory. kernel: vsock/vmci: fix UAF when peer resets connection during handshake CVE-2026-64115 kernel: packet: use consistent hardheaderlen in non-ring send pat...

EulerOS 2.0 SP15 : libxml2 (EulerOS-SA-2026-3991)

According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell function...

Rocky Linux 8 [CIQ] Security Update: ghostscript / ghostscript-debuginfo / ghostscript-debugsource / etc (crlsa-2026_76877)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202676877 advisory. ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter CVE-2026-39919 Tenable has extracted the preceding description block directly from the...

EulerOS 2.0 SP15 : glib2 (EulerOS-SA-2026-3910)

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loading a key file...

PT-2026-108140

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. This allows subsequent append or comparison operations to underfl...

openssl security update

3.5.8-2.0.1 - Replace upstream references Orabug: 34340177 - Update FIPS provider name Orabug: 35824276 1:3.5.8-2 - Fixes DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 Resolves: RHEL-264466...

cjose security update

0.6.2.2-7.1 - Fix CVE-2026-53938: heap buffer overflow in AES key unwrap Resolves: RHEL-256962...

RHEL 8 : kernel (RHSA-2026:77498)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77498 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: vsock/vmci: fix UAF when peer...

Fedora 43 : chromium (2026-02902c2fa0)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-02902c2fa0 advisory. Update to 154.0.8037.97, includes 11 security fixes CVE-2026-103621: Integer overflow in Compositing CVE-2026-103622: Use after free in SVG...

Fedora 44 : chromium (2026-bcdfa4c7db)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bcdfa4c7db advisory. Update to 154.0.8037.97, includes 11 security fixes CVE-2026-103621: Integer overflow in Compositing CVE-2026-103622: Use after free in SVG...