PT-2026-120773

The user-mode verifier for the peci transfer system call, z vrfy peci transfer in drivers/peci/peci handlers.c, checked only the device object permission and copied the caller-supplied struct peci msg with k usermode from copy. That copy validates the outer structure only; the buf pointers and le...

PT-2026-120533

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server with Redis service enabled can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and...

PT-2026-120562

NULL pointer dereference in the RTMP protocol implementation in Apache bRPC version onfail id, causing the process to crash. Affected Scenarios: Run an Apache bRPC RTMP server whose RtmpService::NewStream may return null i.e., the service rejects createStream requests. A remote client that sends ...

PT-2026-120649

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

PT-2026-120724

The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which registers a new schema version for an existing topic. The broker handled both commands after checking only that the client connection was...

PT-2026-120556

CISA's Oct 20 ICS batch included WAGO CC100/PFC100/PFC200 G2 controllers: OS command injection CVE-2026-80466 CVSS 8.8, fixed in firmware 4.10.0. No known exploitation. CISA has since pulled the advisory page. CISA https://t.co/TsmiXvyZGV ICS...

AlmaLinux 10 : lrzsz (ALSA-2026:86056)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

CentOS Linux 7 [TuxCare] Security Update: openssh / openssh-askpass / openssh-cavs / openssh-clients / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792158099)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792158099 advisory. - In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt...

Fedora 44 : dolphin (2026-85f07f4f1b)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-85f07f4f1b advisory. - CVE-2026-110236 Arbitrary command execution via crafted folder name Tenable has extracted the preceding description block directly from the Fedora security...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: lrzsz (UTSA-2026-142360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142360 advisory. lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying...

RHEL 8 : kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_125_1, kpatch-patch-4_18_0-553_158_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 (RHSA-2026:81523)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81523 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

RockyLinux 8 : emacs (RLSA-2026:80506)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:80506 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: local shell command injection through the use...

Fedora 44 : perl-Net-Whois-Raw (2026-78d9d79627)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-78d9d79627 advisory. Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. This tool...

FreeBSD : Emacs -- Local command injection via crafted file names in TRAMP (436ad1a7-ccc8-11f1-af18-c4ff99d93a55)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 436ad1a7-ccc8-11f1-af18-c4ff99d93a55 advisory. TRAMP Transparent Remote file Access, Multiple Protocol is a part of Emacs that provides an...

Linux Distros Unpatched Vulnerability : CVE-2026-102827

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, th...

RHEL 9 : kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_146_1, and kpatch-patch-5_14_0-427_84_1 (RHSA-2026:81449)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81449 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

AlmaLinux 10 : emacs (ALSA-2026:84591)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84591 advisory. emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image CVE-2026-77219 emacs: emacs: Command injection via crafted filename...

RHEL 9 : goose (RHSA-2026:80764)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:80764 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to:...

RHEL 10 : goose (RHSA-2026:80765)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:80765 advisory. For details on how to apply this update, which includes the changes described in this advisory, refer to:...

Debian dla-4831 : libgit2-1.5 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4831 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4831-1 [email protected]...