PT-2026-107008

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An observable discrepancy in the Paint process allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using a...

PT-2026-107011

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use of released resource in Core allows a remote attacker who has compromised the renderer process to potentially obtain cross-origin data through a crafted HTML page. A use of releas...

PT-2026-106388

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...

CVE-2026-105865: Improper Limitation of a Pathname to a Restricted Directory

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update or delete uploads stored locally can cause file cleanup to remove unintended files outside the configured upload...

CVE-2026-106501: Exposure of Sensitive Information to an Unauthorized Actor

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

PT-2026-106371

Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...

PT-2026-107138

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...

CVE-2026-98263: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

PT-2026-106826

Name of the Vulnerable Software and Affected Versions Quasar Framework versions 1.0.0 through 3.2.9 Description The @quasar/app-vite component recursively removes the resolved build.distDir before the build process begins. It fails to reject the project root, user home directory, filesystem roots...

ROS-20261006-73-0119

The vulnerability of the spiregistercontroller function in the drivers/spi/spi.c module of the Linux operating system’s SPI device driver lies in the repeated use of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-106224: Missing Authorization

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106217: Missing Authorization

Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106361

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

Linux Distros Unpatched Vulnerability : CVE-2026-98304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen...

Linux Distros Unpatched Vulnerability : CVE-2026-59782

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The JavaScript preprocessing Duktape engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data potentially resulti...

Kibana 9.0.x < 9.4.7 / 9.5.x < 9.5.4 Incorrect Authorization (ESA-2026-187)

The version of Kibana installed on the remote host is 9.0.x prior to 9.4.7, or 9.5.x prior to 9.5.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-187 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Kibana could lead to cross-tenant data...

RHEL 10 : openssh (RHSA-2026:76748)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76748 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

Linux Distros Unpatched Vulnerability : CVE-2026-98298

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the...

AlmaLinux 8 : ruby:2.5 (ALSA-2026:73519)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73519 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo: MongoDB Ruby Driver: Data...

Linux Distros Unpatched Vulnerability : CVE-2026-98189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: wilc1000: fix RX buffer OOB-write in wilcwlanhandleisrext wilcwlanhandleisrext takes the RX transfer size from the device-reported interrupt status regist...