PT-2026-77201

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

PT-2026-76948

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...

PT-2026-77290

Dell Alienware Command Center AWCC, versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service and Elevation of Privilege...

Linux Distros Unpatched Vulnerability : CVE-2026-72092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/amdxdna: reject command submission on devices without a submit op amdxdnacmdsubmit calls xdna-devinfo-ops-cmdsubmit unconditionally, but only aie2devops...

Linux Distros Unpatched Vulnerability : CVE-2026-68469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sle...

RHEL 9 : redhat-ds:12 (RHSA-2026:56048)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56048 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

RHEL 8 : 389-ds:1.4 (RHSA-2026:55794)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55794 advisory. 389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP...

Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

RHEL 10 : pcp (RHSA-2026:55617)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55617 advisory. Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance...

RHEL 10 : kpatch-patch-6_12_0-211_16_1 (RHSA-2026:55618)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:55618 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This pat...

Amazon Linux 2 : sg3_utils, --advisory ALAS2-2026-3860 (ALAS-2026-3860)

The version of sg3utils installed on the remote host is prior to 1.37-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3860 advisory. A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102136)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102136 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGACMDMAXDATASIZE This data originates from...

RockyLinux 10 : pcp (RLSA-2026:55617)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55617 advisory. PCP: PCP linuxsockets PMDA: Arbitrary Command Execution via Command Injection CVE-2026-16524 PCP: PCP: Privilege escalation to root via linuxsockets PM...

PT-2026-77209

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

Oracle Linux 10 : pcp (ELSA-2026-55617)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55617 advisory. - Fix CVE-2026-16530: pmLogLoadInDom OOB pointer dereference RHEL-213746 - Fix CVE-2026-16531: pmproxy logger servlet path traversal RHEL-213756 - Fi...

Security update for python-PyPDF2 (moderate)

openSUSE security update: security update for python-pypdf2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21589-1 Rating: moderate References: bsc1271146 bsc1271147 Cross-References: CVE-2026-59936 CVE-2026-59937 Affected Products: openSUSE Leap...

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

PT-2026-77162

CodeWhale versions before 0.8.64 fail to properly validate the allow shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

PT-2026-76946

ArcadeDB before 26.8.1 affected versions = 26.7.3 contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermissionsOnDatabase UPDATE SCHEMA check. Any...

PT-2026-77317

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepted a cwd working-directory parameter and checked only whether the...