Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-106780)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106780 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttprewritemodule module. This vulnerability exists when a rewrite directive uses a regex pattern wit...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-106783)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106783 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttprewritemodule module. This vulnerability exists when a rewrite directive uses a regex pattern wit...

Microsoft Visual Studio Products (September 2026)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. CVE-2026-69439 - Heap-based buffer overflow in...

PT-2026-89210

Public Runtime Config Exposes Ollama API Key to Browser Clients Summary [email protected] unconditionally merges all module options — including api key — into Nuxt's public runtime config runtimeConfig.public.ollama. Nuxt serializes runtimeConfig.public into the SSR HTML response inside a payloa...

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

openSUSE 16: java-17-openjdk / java-17-openjdk-demo / java-17-openjdk-devel / etc (openSUSE-SU-2026:21745-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21745-1 advisory. Upgrade to upstream tag jdk-17.0.20.1+1 August 2026 CSPU. - CVE-2026-60589: unauthenticated attacker with network access via multiple protocols...

Linux Distros Unpatched Vulnerability : CVE-2026-87435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensiti...

AlmaLinux 8 : thunderbird (ALSA-2026:65160)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:65160 advisory. firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component CVE-2026-74934 firefox: thunderbird: Privilege escalation in the...

Linux Distros Unpatched Vulnerability : CVE-2026-87452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potential...

RockyLinux 9 : pam (RLSA-2026:64815)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:64815 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...

Palo Alto Networks PAN-OS 11.1.x < 11.1.16-h2 / 11.2.x < 11.2.13-h2 / 12.1.x < 12.1.10 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 11.1.x prior to 11.1.16-h2, 11.2.x prior to 11.2.13-h2, or 12.1.x prior to 12.1.10. It is, therefore, affected by a vulnerability. A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables a...

Oracle Linux 8 : ELSA-2026-63014-0: / kernel (ELSA-2026-630140)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-630140 advisory. - net: ipv6: clear suppressed fib6 rule result Jamie Bainbridge RHEL-246806 CVE-2026-74581 - RHEL only: Disable zram writeback support on non-4k page...

Oracle Linux 9 : ELSA-2026-65158-0: / thunderbird (ELSA-2026-651580)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-651580 advisory. 140.14.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.14.0 - Add OpenELA debranding 140.14.0-1 - Update to 140.14.0 ESR...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: wget (UTSA-2026-106779)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106779 advisory. GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allow...

Linux Distros Unpatched Vulnerability : CVE-2026-87795

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads...

Linux Distros Unpatched Vulnerability : CVE-2026-87429

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass syst...

Linux Distros Unpatched Vulnerability : CVE-2026-87456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outsid...

Linux Distros Unpatched Vulnerability : CVE-2026-80925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vlan: fix skbunderpanic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload NETIFFHWVLANCTAGTX or NETIFFHWVLANSTAGTX on a lower device...

Security Updates for Microsoft Access Products (September 2026)

The Microsoft Access Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Access allows an authorized attacker to execute code locally. CVE-2026-69477 - Heap-based buffer overflow in Microsoft Office...

Linux Distros Unpatched Vulnerability : CVE-2026-87736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. CVE-2026-877...