PT-2026-34209

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An incorrect regular expression allows an attacker to bypass OAuth redirect URI validation. An attacker aware of a first-party OAuth application's registered callback URL can create a...

PT-2026-34235

Description Noir programs can invoke external functions through foreign calls. When compiling to Brillig bytecode, the SSA instructions are processed block-by-block in BrilligBlock::compile block. When the compiler encounters an Instruction::Call with a Value::ForeignFunction target, it invokes...

PT-2026-34203

WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit 986e64aad is incomplete. Two separate code paths still reflect arbitrary Origin headers with credentials allowed for all /api/ endpoints: 1 plugin/API/router.php lines 4-8...

PT-2026-34225

Name of the Vulnerable Software and Affected Versions free5GC AMF versions prior to 1.4.3 Description The HTTPUEContextTransfer handler in internal/sbi/api communication.go lacks a default case in the Content-Type switch statement. If a request is sent with an unsupported Content-Type, the...

PT-2026-34211

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An improper authorization issue exists where an authenticated attacker can determine the names of private repositories using their numeric ID. This occurs because the mobile upload...

PT-2026-34021

RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters private location entries in website/web/api/genericapi.py. Because the code removes elements from a list while iterating over it, entries...

PT-2026-34212

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An improper authorization issue exists in scoped user-to-server ghu token authorization. An authenticated attacker can access private repositories outside the intended installation...

Security update for python313 (important)

openSUSE security update: security update for python313 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20517-1 Rating: important References: bsc1257181 bsc1259240 bsc1259611 bsc1259734 bsc1259735 bsc1259989 bsc1260026 Cross-References: CVE-2025-134...

Security update for libraw (important)

openSUSE security update: security update for libraw ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20574-1 Rating: important References: bsc1261499 bsc1261671 bsc1261672 bsc1261673 bsc1261674 bsc1261675 bsc1261676 Cross-References: CVE-2026-20884...

Mozilla -- Spoofing issue

https://bugzilla.mozilla.org/showbug.cgi?id=2021080 reports: Spoofing issue in the DOM: Core & HTML component...

Mozilla -- Invalid pointer

https://bugzilla.mozilla.org/showbug.cgi?id=2022746 reports: Invalid pointer in the Audio/Video: Playback component...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=2016915 reports: Mitigation bypass in the DOM: Security component...

Mozilla -- Information disclosure

https://bugzilla.mozilla.org/showbug.cgi?id=2022419 reports: Information disclosure in the Form Autofill component...

Mozilla -- Use-after-free

https://bugzilla.mozilla.org/showbug.cgi?id=2013619 reports: Use-after-free in the JavaScript: WebAssembly component...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011230)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011230 advisory. In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Fix BUGON in probe function The snddmabuffer.bytes field now contains the aligned...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010942)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010942 advisory. In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of...

AlmaLinux 8 : kernel-rt (ALSA-2026:9135)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:9135 advisory. kernel: scsi: qla2xxx: Fix improper freeing of purex item CVE-2025-68741 kernel: ALSA: aloop: Fix racy access at PCM trigger CVE-2026-23191 Tenable has...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011335)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011335 advisory. In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix a refcount bug in qrtrrecvmsg Syzbot reported a bug as following: refcountt:...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-013349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013349 advisory. In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in biotruncate biotruncate clears the buffer outside of last block of bde...

MiracleLinux 8 : firefox-140.9.1-1.el8_10.ML.1 (AXSA:2026-480:08)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-480:08 advisory. libpng: libpng: Arbitrary code execution due to use-after-free vulnerability CVE-2026-33416 libpng: libpng: Information disclosure and denial of...