AlmaLinux 9 : aspell (ALSA-2026:92458)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:92458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

RHEL 9 : aspell (RHSA-2026:92458)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92458 advisory. GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-110133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypa...

RockyLinux 10 : bind (RLSA-2026:92419)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:92419 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP...

Linux Distros Unpatched Vulnerability : CVE-2026-119269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793085399)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793085399 advisory. - In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit...

CentOS Linux 6 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-cron / rpm-devel / rpm-libs / etc (CENTOS6:CLSA-2026:1793110602)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793110602 advisory. - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to...

Linux Distros Unpatched Vulnerability : CVE-2026-119262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-119266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. Fix has been pushed to the following open-source versions: v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stabl...

PT-2026-133516

Details per Volexity: the victim ran then-current 22.8R2.4. After root, the actor took domain/LDAP service credentials, searched AD for LAPS passwords and BitLocker keys, and erased log entries. CVE-2026-118527 authenticated file upload also joined KEV Oct 30 as chainable with both...

CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1...

PT-2026-133603

Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, multiple eval calls in the vendored PEAR HTML QuickForm libraries can execute arbitrary PHP code if form element names contain attacker-influenced data. Standard Chamilo forms...

PT-2026-133735

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.1.4 WordPress versions prior to 7.0.8 WordPress versions prior to 6.9.11 WordPress versions prior to 4.7.39 Description A remote code execution issue exists during the core upgrade process. When a full upgrade...

RHEL 7 : httpd (RHSA-2026:92590)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92590 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

Linux Distros Unpatched Vulnerability : CVE-2026-119138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure afte...

PT-2026-134170

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1793364521)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793364521 advisory. - An out-of-bounds access flaw was found in the Linux kernel's implementation of the eBPF code verifier in the way a user running th...

astro-notion-blog 0.13.0 Path Traversal / Remote Code Execution

astro-notion-blog version 0.13.0 allows Notion database editors to supply an encoded FeaturedImage filename that escapes the image directory during site builds, overwrites an Astro page, and enables code execution as the build user. https://packetstorm.news/download/238545...