Linux Distros Unpatched Vulnerability : CVE-2026-99005

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work,...

Linux Distros Unpatched Vulnerability : CVE-2026-98950

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hle...

Linux Distros Unpatched Vulnerability : CVE-2026-99052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc...

Linux Distros Unpatched Vulnerability : CVE-2026-99072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c net: ipv4: Emit notification when fib hardware flags are changed added an...

Linux Distros Unpatched Vulnerability : CVE-2026-98999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in...

Cisco IOS XR Software for ASR 9000 Series Routers IPv4 Unicast Packets DoS (cisco-sa-asr9k-tUyxcyXN)

According to its self-reported version, Cisco IOS XR is affected by a vulnerability. - A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact...

Linux Distros Unpatched Vulnerability : CVE-2026-99007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills i...

Linux Distros Unpatched Vulnerability : CVE-2026-99041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan...

PT-2026-122443

Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...

CVE-2026-74048

Not Failing Securely Failing Open vulnerability in Apache Tomcat...

Linux Distros Unpatched Vulnerability : CVE-2026-99082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached...

CVE-2026-101356

Incorrect object recycling and re-use vulnerability in Apache Tomcat a...

Linux Distros Unpatched Vulnerability : CVE-2026-98955

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ?...

PT-2026-122410

Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding for example gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one val...

PT-2026-122459

On Windows, ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock connect SQLite to the lock database by its path, in every directory. SQLite derives three side files from that path: -journal, the rollback journal pages saved to undo an interrupted write; -wal, the write-ahead...

PT-2026-122458

On Windows the soft locks SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async forms, and a FileLock that fell back to a soft lock read their marker by path. The marker is the lock file whose presence says a process holds the lock. Each acquire attempt that finds a marker opens it with...

PT-2026-122205

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.21.2 Description An attacker can craft a PDF file with a standard cross-reference table where the declared entry count exceeds the actual capacity of the file. When such a file is opened, it leads to excessive...

PT-2026-122233

Name of the Vulnerable Software and Affected Versions MLflow versions 3.12.0rc0 through 3.16.x Description An unauthenticated attacker can force the tracking server to make an outbound HTTP request to an arbitrary host, including internal services or cloud-metadata endpoints, with...

PT-2026-122447

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the auth code flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the auth code to to...

PT-2026-122240

Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 7.1.3 Description The software fails to properly neutralize a bare closing-script prefix when the source text of a function ends exactly with that prefix. Because function bodies are escaped independently...