CVE-2026-58090 Use-after-free in unix SOCK_STREAM message handling

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

EUVD-2026-66235

The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this...

CVE-2026-58090

CVE-2026-58090 is a use-after-free in FreeBSD 's core unix module, affecting FreeBSD 15.0 and later . The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing; certain error paths would free those messages, lea...

PAN-OS Management Web Interface - Authentication Bypass

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.16.69 security update

Red Hat build of MicroShift release 4.16.69 is now available with updates to packages and images that include a security update. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

PT-2026-82323

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description The S3 API accepts an external OIDC JWT OpenID Connect JSON Web Token sent directly in the Authorization header and maps it to an IAM role without enforcing the trust policy of that role. While the...

PT-2026-82094

Name of the Vulnerable Software and Affected Versions OpenZFS affected versions not specified Description On Linux, several ioctl authorization checks incorrectly treat capabilities held within a user-created, unprivileged namespace as equivalent to actual host privileges. This allows an...

AlmaLinux 10 : attr (ALSA-2026:59380)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59380 advisory. attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 Tenable has extracted the preceding description block directly from the...

PT-2026-82088

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 3.11.0 through 3.17.0 Description An issue exists where the attach-consumer-label plugin fails to correctly sanitize certain input values. This allows an attacker to perform an authorization bypass or escalate privileges...

CVE-2025-56798

Cross-Site Request Forgery CSRF vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy...

EUVD-2025-210791

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

PT-2026-82333

Name of the Vulnerable Software and Affected Versions KubePi versions prior to 2.0.0 Description SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, allowing SSO, OIDC, and SAML management operations to be accessed without...

CVE-2026-52473

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder...

attr security update

2.6.0-1 - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr RHEL-186121...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: hibernate-validator (UTSA-2026-093593)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093593 advisory. In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access th...

Linux Distros Unpatched Vulnerability : CVE-2026-80560

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openrisc: signal: do not restore privileged SR bits on sigreturn restoresigcontext copies the whole supervision register SR from the signal frame and only clea...

AlmaLinux 9 : firefox (ALSA-2026:58897)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:58897 advisory. firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component CVE-2026-74983 firefox: thunderbird: Site isolation issue in the Graphics:...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:3683-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3683-1 advisory. Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-74 bsc1274867: - CVE-2026-74934: Site isolation issue in the Graphics:...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)

"The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8663-1 advisory. It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. ...