Linux Distros Unpatched Vulnerability : CVE-2026-31448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the...

PT-2026-34489

Name of the Vulnerable Software and Affected Versions uutils coreutils affected versions not specified Description The mkdir utility incorrectly applies permissions when the -m flag is used. The utility creates a directory with umask-derived permissions typically 0755 and then changes them to the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013576)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013576 advisory. In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by dosubmiturb There are UAF bugs caused by...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013828)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013828 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/meson: explicitly remove aggregate driver at module unload time Because componentmasterdel...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013745)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013745 advisory. In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Clear nfctarget before being used Fix a slab-out-of-bounds read that occurs in nlaput...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013767 advisory. In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state-timer is ...

Linux Distros Unpatched Vulnerability : CVE-2026-35358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The cp utility in uutils coreutils, when performing recursive copies -R, incorrectly treats character and block device nodes as stream sources rather than...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013533)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013533 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix musbgadget.c rxstate overflow bug The usb function device call musbgadgetqueue ad...

AlmaLinux 9 : kernel (ALSA-2026:8921)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:8921 advisory. kernel: net/sched: Make cakeenqueue return NETXMITCN when past bufferlimit CVE-2025-39766 kernel: scsi: qla2xxx: Fix improper freeing of purex item...

RHEL 10 / 9 : java-25-openjdk (RHSA-2026:9693)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:9693 advisory. The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fixe...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013596)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013596 advisory. In the Linux kernel, the following vulnerability has been resolved: clk: zynqmp: Fix stack-out-of-bounds in strncpy BUG: KASAN: stack-out-of-bounds in...

PT-2026-34418

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack-out-of-bounds read exists in the Bluetooth L2CAP component. The function l2cap ecred conn req allocates a local stack buffer pdu to hold up to 5 Source Channel IDs SCIDs. When a...

Linux Distros Unpatched Vulnerability : CVE-2026-31456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/pagewalk: fix race between concurrent split and refault The splitting of a PUD entry in walkpudrange can race with a concurrent thread refaulting the PUD lea...

EUVD-2026-24574

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database...

CVE-2026-41133 pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database...

CVE-2026-41133

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache role and permission in the session at login and continues to authorize requests using these cached values, even after an admin changes the user's role/permissions in the database...

CVE-2026-4821

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it was published in error...

CVE-2026-4296

An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge of a first-party OAuth application's registered callback URL could craft a malicious authorization link that, when...

CVE-2026-41060 AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

WWBN AVideo is an open source video platform. In versions 29.0 and below, the isSSRFSafeURL function in objects/functions.php contains a same-domain shortcircuit lines 4290-4296 that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares on...

CVE-2026-5845 Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server

An improper authorization vulnerability in scoped user-to-server ghu token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that...