PT-2026-82365

Name of the Vulnerable Software and Affected Versions Content Moderation Notifications versions 0.0.0 through 3.9.0 Description An issue exists where a permission allowing users to configure email templates containing Twig a template engine for web pages was not marked as restricted. If a site...

Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

Dell Watchdog Timer < 2.0.0.1 Privilege Escalation (DSA-2026-248)

According to its self-reported version, the Dell Watchdog Timer kernel driver WDTKernel.sys on the remote Windows host is prior to 2.0.0.1. It is, therefore, affected by an exposed IOCTL with insufficient access control vulnerability. A low privileged local attacker could potentially exploit this...

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

Red Hat Automatic Bug Reporting Tool ABRT contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted products could be end-of-life EoL and/or end-of-service EoS. Users...

RHEL 9 : iscsi-initiator-utils (RHSA-2026:60427)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:60427 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpng12 (UTSA-2026-093190)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093190 advisory. Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows...

Linux Distros Unpatched Vulnerability : CVE-2026-74752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093166)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093166 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrftoken value is not specific to a single user account. An attacker can obtain a value within th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-Encode (UTSA-2026-093243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093243 advisory. Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in the current working directo...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-8665-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8665-1 advisory. It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative...

Linux Distros Unpatched Vulnerability : CVE-2026-70665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client...

RHEL 9 : attr (RHSA-2026:60226)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60226 advisory. The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, ...

RHCOS 4 : Red Hat build of MicroShift 4.16.69 (RHSA-2026:57845)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57845 advisory. - net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGSMAXFRAMESIZE frame...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093169)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093169 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, and may be useful in conducting a...

FreeBSD : FreeBSD -- Unauthorized credential switching (55fbe7b1-a0fe-11f1-ae1f-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 55fbe7b1-a0fe-11f1-ae1f-bc241121aa0a advisory. In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primar...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: trousers (UTSA-2026-093156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093156 advisory. An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges instead of by the tss user, it fails to drop the root gid...

CVE-2026-80202 Kimai before 2.56.0 Authorization Bypass via TimesheetVoter

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute, which maps permissions only to owntimesheet or othertimesheet. As a result, any authenticated user with ROLETEAMLEAD or a role holding editothertimesheet/deleteothertimesheet can read, modify, and...

DEBIAN-CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-70665

Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. Under certai...

CVE-2026-80184

In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms OAuth1 access tokens, application credentials, trusts could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential...