Linux Distros Unpatched Vulnerability : CVE-2025-25977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. CVE-2025-25977 Note that Nessus relies on...

Linux Distros Unpatched Vulnerability : CVE-2026-64846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102069)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102069 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: reserve enough transaction items for qgroup ioctls Currently our qgroup ioctls don't...

openSUSE 16 Security Update : go1.25 (openSUSE-SU-2026:21592-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21592-1 advisory. Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead...

Kibana 8.9.x < 8.19.19 / 9.x < 9.4.5 Missing Authorization (ESA-2026-86)

The version of Kibana installed on the remote host is 8.9.x prior to 8.19.19, or 9.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-86 advisory. - The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created th...

Vulnerability of the rpc_client_recv_fragment() function in the libfreerdp/core/gateway/rpc_client.c file of the RDP client FreeRDP, which allows a attacker to cause a service failure and execute arbitrary code.

The vulnerability of the rpcclientrecvfragment function in the libfreerdp/core/gateway/rpcclient.c file of the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause service failures and execute arbitrary code...

PT-2026-79465

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

UBUNTU-CVE-2026-18295

GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution V...

...[ More ]

Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...

openSUSE 16 Security Update : gitea-tea (openSUSE-SU-2026:21603-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21603-1 advisory. Changes in gitea-tea: - Update to 0.15.1, bringing in the 0.14.2/0.15.0/0.15.1 upstream changes below bsc1253576: CVE-2025-47913:...

PT-2026-79461

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

Microsoft Edge (Chromium) < 151.0.4129.101 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.101. It is, therefore, affected by multiple vulnerabilities as referenced in the August 20, 2026 advisory. - Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102049)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102049 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add bounds checking to ibget,setvalue The uvd/vce/vcn code accesses the IB at...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102096 advisory. In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the font buffer if the reallocation...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-102703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102703 advisory. A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execution or cause denial of service via the chann...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102076 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an...

The vulnerability of the KGSL driver for graphics processors in Qualcomm’s embedded software allows a hacker to enhance their privileges and execute arbitrary code.

The vulnerability of the KGSL driver for graphics processors in Qualcomm’s embedded software lies in the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to elevate their privileges to root level and execute arbitrary code...

PT-2026-79386

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse resultat skel...

PT-2026-79410

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parse artifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eva...

PT-2026-79355

Using untrusted, non-normalized input as-is for metrics data such as metric names, tag keys, or tag values is a dangerous antipattern that general-purpose instrumentation should never perform. When such unsafe instrumentation is used, the application becomes vulnerable to injection and spoofing...