The vulnerability of the usbtmc Interrupt() function in the drivers/usb/class/usbtmc.c module of the Linux operating system’s USB device driver allows a hacker to cause a service failure.

The vulnerability of the usbtmc Interrupt function in the drivers/usb/class/usbtmc.c module of the Linux USB device driver framework is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the tls_push_record() function in the net/tls/tls_sw.c module of the Linux operating system’s TLS protocol implementation allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tlspushrecord function in the net/tls/tlssw.c module of the TLS protocol implementation in the Linux operating system is related to incorrect handling of structure elements. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrit...

The vulnerability of the tlbFlush() function in the arch/arm64/include/asm/tlb.h header of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tlbFlush function in the arch/arm64/include/asm/tlb.h header of the Linux operating system’s kernel is related to the dereferencing of a pointer whose validity has expired. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

The vulnerability of the iucv_sock_getsockopt() function in the net/iucv/af_iucv.c module, which is part of the Linux kernel’s networking functions, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iucvsockgetsockopt function in the net/iucv/afiucv.c module, which implements networking functions in the Linux kernel, is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the mxuport_calc_num_ports() function in the drivers/usb/serial/mxuport.c module of the Linux operating system’s USB device driver framework allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mxuportcalcnumports function in the drivers/usb/serial/mxuport.c module of the Linux device driver framework is related to the copying of buffers without checking input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrit...

The vulnerability of the ucsi_handle_connector_change() function in the drivers/usb/typec/ucsi/ucsi.c module of the UCSI interface driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ucsihandleconnectorchange function in the drivers/usb/typec/ucsi/ucsi.c file of the UCSI interface driver for the Linux operating system is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to...

PT-2026-89210

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including api key — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payloa...

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

mrtg security update

2.17.7-1.1 - Fix CVE-2026-72694: symlink-following chown in PID file handling Resolves: RHEL-236037...

ALSA-2026:65832 Important: mrtg security update

The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fixes: mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID...

ALSA-2026:66248 Important: ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

redis:6 security update

6.2.24-1.0.1 - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 6.2.24-1 - rebase to 6.2.24 for CVE-2026-66373...

RockyLinux 8 : redis:6 (RLSA-2026:64823)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64823 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Arbitrary code execution via TLS pending-data lis...

ALSA-2026:66000 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: crypto: pcrypt - Fix handling of MAYBACKLOG requests CVE-2026-43493 kernel: netfilter: conntrack: remove sprintf usage CVE-2026-53002 kernel: netfilter: synproxy: refresh tcphdr after...

RockyLinux 9 : opentelemetry-collector (RLSA-2026:65117)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:65117 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Oracle Linux 9 : ELSA-2026-64812-0: / expat (ELSA-2026-648120)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-648120 advisory. - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Fix CVE-2026-50219 Tenable has extracted the preceding description block...

MiracleLinux 8 : kernel-4.18.0-553.158.1.el8_10 (AXSA:2026-1794:77)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1794:77 advisory. kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64 decode...

RockyLinux 10 : image-builder (RLSA-2026:65534)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:65534 advisory. crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation CVE-2026-32281 crypto/x509: golang: Go crypto/x509:...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: wget (UTSA-2026-106776)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106776 advisory. GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c that allows a remote...

RockyLinux 8 : 389-ds:1.4 (RLSA-2026:64791)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64791 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...