Linux Distros Unpatched Vulnerability : CVE-2026-74320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2053)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2053 advisory. FreeRDP before 3.28.0 affected outlength, so out-of-bounds bytes are written before the bounds check. On the server side, when a client selects RDP Standard Security, the encrypted client rand...

PT-2026-77162

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description Insufficient validation of the allow shell configuration parameter within project config files allows for arbitrary shell command execution. An attacker can achieve this by committing a malicious...

PT-2026-77317

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepted a cwd working-directory parameter and checked only whether the...

PT-2026-77164

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63 Description An argument injection issue exists in the git show tool. The rev parameter is passed unvalidated into the git show argument vector without an --end-of-options sentinel, allowing a value...

PT-2026-77179

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when t...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

PT-2026-78228

Name of the Vulnerable Software and Affected Versions Linuxfabrik Monitoring Plugins versions prior to 7.0.0 Description The check-plugins/logfile/logfile plugin accepts a free-form --filename path and opens it with root privileges when invoked via the provided nagios or icinga sudoers allowlist...

EUVD-2026-61095

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

CVE-2026-52607

A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...

PT-2026-77233

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico criteria parameter in conjunction with the execute mode=CRITERIA parameter of run.php...

Linux Distros Unpatched Vulnerability : CVE-2026-72158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fpga: dfl: add bounds check in dfhgetparamsize dfhgetparamsize can return a parameter size larger than the feature region because the loop bounds check is...

AlmaLinux 10 : php (ALSA-2026:48170)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48170 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

PT-2026-77161

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat smplooped in src/load pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat loops, so an index of zero reads pat loops-1, one byt...

CVE-2026-52607

reportico-web versions up to and including 8.1.0 are affected by a directory traversal vulnerability in the run.php endpoint. By supplying a crafted filename in the target_format parameter combined with execute_mode=EXECUTE, a remote unauthenticated attacker can expose or execute arbitrary PHP fi...

Linux Distros Unpatched Vulnerability : CVE-2026-72483

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the...

Linux Distros Unpatched Vulnerability : CVE-2026-72395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hwmon: pmbus Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 hwmon: pmbus/core Protect regulator operations with mutex introduced a...

AlmaLinux 10 : php8.4 (ALSA-2026:49914)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:49914 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.4.23 for...

Linux Distros Unpatched Vulnerability : CVE-2026-72083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE corescsi3emulateproregisterandmove maps the PERSISTENT RESERVE OUT parameter list with...

Linux Distros Unpatched Vulnerability : CVE-2026-72442

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to use pskbmaypull instead of skbheaderpointer to ensure the outer IPv6...