Linux Distros Unpatched Vulnerability : CVE-2026-68139

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: Use sender devcom for MPV master-up After PCIe DPC recovery, mlx5 reloads the affected functions and replays multiport affiliation events. In the...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500162)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500162 advisory. - KVM: x86: Check for invalid/obsolete root after making MMU pages available Sean Christopherson Orabug: 39832946 CVE-2026-64561 - x86/bugs: Make...

PT-2026-70283

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software for Windows affected versions not specified Description A null pointer dereference within Ring 0 the most privileged level of the CPU of the kernel may lead to a denial of service. An unprivileged,...

PT-2026-70310

Null pointer dereference for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via...

Linux Distros Unpatched Vulnerability : CVE-2026-68392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: mgmt: fix locking in unpairdevice/disconnectsync Dereferencing RCU-protected pointers outside critical sections is invalid and may lead to UAF. Take...

Linux Distros Unpatched Vulnerability : CVE-2026-68317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdscore: fix auxiliary device add/del races Two paths add or delete the same slot pf-vfsvfid.padev: a VF's pdscresetdone and the PF's devlink...

PT-2026-70547

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An untrusted pointer dereference in Windows Win32K allows an authorized attacker to locally disclose sensitive information, which may impact the system. Recommendations At the moment,...

PT-2026-70418

Name of the Vulnerable Software and Affected Versions Microsoft Remote Registry Service affected versions not specified Description A null pointer dereference in the Microsoft Remote Registry Service allows an authorized attacker to cause a denial of service over a network. A null pointer...

PT-2026-70664

Name of the Vulnerable Software and Affected Versions Windows iSCSI Target Service affected versions not specified Description A null pointer dereference in the Windows iSCSI Target Service allows an unauthorized attacker to cause a denial of service over a network. A null pointer dereference...

PT-2026-70053

Name of the Vulnerable Software and Affected Versions ASUS GPU Tweak III affected versions not specified ASUS GPU Tweak II affected versions not specified ASUS AI Suite 3 affected versions not specified VGAdll affected versions not specified Description An untrusted pointer dereference exists...

PT-2026-70431

Name of the Vulnerable Software and Affected Versions Windows GDI affected versions not specified Description An untrusted pointer dereference in Windows GDI allows an authorized attacker to disclose sensitive information locally. Recommendations At the moment, there is no information about a new...

PT-2026-70061

Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The USB DFU class implementation in the experimental device next USB device stack contains a NULL pointer dereference within the handle download function. This occurs when the handler processe...

PT-2026-70306

Null pointer dereference for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via...

Linux Distros Unpatched Vulnerability : CVE-2026-68311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO...

PT-2026-70638

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-68105

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix kernel panic during driver load failure Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES. BUG: kernel NULL pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-68346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ALSA: hda: cs35l41: validate and free ACPI mute object cs35l41getacpimutestate evaluates a DSM method to get the ACPI mute state and reads the first byte from t...

Oracle Linux 10 : kernel (ELSA-2026-34911)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-34911 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

CVE-2026-72904

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in...

CVE-2026-11810

The UpdateHub firmware-update agent's probe handler zimplupdatehubprobe in subsys/mgmt/updatehub/updatehub.c parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length objectslen != 2 and then...