PT-2026-77211

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill,...

PT-2026-77145

Pyenv provides simple Python version management. Prior to 2.8.0, is version safe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

PT-2026-78234

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.8 Description An issue exists when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The 'POST /api/register' endpoin...

PT-2026-77268

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

PT-2026-78233

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.8 Description An authenticated project manager can use traversal sequences in the filename parameter of the 'GET /exports/:id/:filename' endpoint. In the server/api/controllers/boards/download.js file, the...

CVE-2026-57826

openHiTLS versions 0.2.0 through 0.3.2 contain a critical vulnerability (CVSS 9.8 ) in X.509 certificate chain verification . The basic constraints extension and CA flag of intermediate CAs are only validated for v3 certificates; v1 and v2 certificates are silently ignored, allowing an attacker t...

Linux Distros Unpatched Vulnerability : CVE-2026-72094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-fence: Fix potential NULL pointer dereference The commit mentioned in the fixes...

Linux Distros Unpatched Vulnerability : CVE-2026-72089

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - accel/ivpu: Reject firmware log with size smaller than header fwlogfrombo validates the tracing buffer headersize and that the log fits within the BO, but never...

Linux Distros Unpatched Vulnerability : CVE-2026-72020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd ipvs: avoid kmemcachezalloc in ipvsconnnew changed ipvsconnnew to allocate an ipvsconn objec...

Linux Distros Unpatched Vulnerability : CVE-2026-74439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry devicepasidtableteardown zeroes the 128-bit scalable-mode context entry with...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101961)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101961 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes WARNING With extra warning o...

Linux Distros Unpatched Vulnerability : CVE-2026-68455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to...

Linux Distros Unpatched Vulnerability : CVE-2026-74320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks...

Linux Distros Unpatched Vulnerability : CVE-2026-72223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: Free arena sub-allocations on discoverarenas error path Memory allocated by bttfreelistinit, bttrttinit, and bttmaplocksinit is not freed on some...

PT-2026-77160

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description Insufficient validation of file paths in the project config instructions field allows for the reading of arbitrary files on a system. An attacker can use a malicious .codewhale/config.toml file...

Linux Distros Unpatched Vulnerability : CVE-2026-74311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - virtio: rtc: tear down old virtqueues before restore virtiodevicerestore resets the device and restores the negotiated features before calling -restore...

Linux Distros Unpatched Vulnerability : CVE-2026-72266

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: vesafb: fix memory leak in vesafbprobe Since commit 73ce73c30ba9 fbdev: Transfer video= option strings to caller; clarify ownership the string returned...

Linux Distros Unpatched Vulnerability : CVE-2026-72127

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netdev-genl: report NAPI thread PID in the caller's pid namespace netdevnlnapifillone reports the NAPI kthread PID in NETDEVANAPIPID using taskpidnr, which...

Linux Distros Unpatched Vulnerability : CVE-2026-72455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fix uninitialised pointer passed to auditloguntrustedstring Commit 4a134723f9f1 apparmor: move check for aanull file to cover all cases intrdouced a...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101993 advisory. In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the...