RHEL 10 : image-builder (RHSA-2026:67139)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67139 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes:...

Linux Distros Unpatched Vulnerability : CVE-2026-90995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder sock...

Linux Distros Unpatched Vulnerability : CVE-2026-89099

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronizatio...

Linux Distros Unpatched Vulnerability : CVE-2026-90577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of th...

Amazon Linux 2 : gstreamer1-plugins-base (ALAS-2026-3922)

The version of gstreamer1-plugins-base installed on the remote host is prior to 1.18.4-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3922 advisory. GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : CivetWeb vulnerabilities (USN-8749-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8749-1 advisory. It was discovered that CivetWeb did not correctly handle parsing certain URIs. A remote attacker could...

Amazon Linux 2023 : bluez, bluez-cups, bluez-deprecated (ALAS2023-2026-2146)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2146 advisory. A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response EIR...

AlmaLinux 8 : nodejs:22 (ALSA-2026:54530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

Oracle Linux 10 : ELSA-2026-67156-0: / perl (ELSA-2026-671560)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671560 advisory. - Fixes: CVE-2026-13221 - regcompstudy: Don't create a trie that would overflow - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir Tenable has extract...

Linux Distros Unpatched Vulnerability : CVE-2026-90804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function bfdelfwritesectionehframe of the file bfd/elf-eh-frame.c of the...

CVE-2023-24283

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service DoS via a crafted save file...

CVE-2023-24288

Simon Tatham's Portable Puzzle Collection (sgt-puzzles) is vulnerable to a buffer overrun triggered by a crafted save file, which can lead to Denial of Service . The vulnerability affects versions before 20230116.5782e29 . The CVSS 3.1 score is 2.9 (LOW) , with a local attack vector, high complex...

CVE-2023-24291

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter...

CVE-2023-24285

Portable Puzzle Collection (sgt-puzzles) versions before 20230116.5782e29 contain a buffer overflow in the Netslide puzzle , triggered when a crafted save file executes an unusually long move. The vulnerability can cause an integer or buffer overflow, leading to a low-impact availability loss (cr...

EUVD-2023-60643

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed...

EUVD-2023-60636

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service DoS via a crafted save file...

EUVD-2023-60647

Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter...

CVE-2023-24284

Portable Puzzle Collection (sgt-puzzles) versions before 20230116.5782e29 contain a buffer overflow in the Guess puzzle , triggered via the is_markable() function when processing a crafted save file . The vulnerability was fixed upstream in commit 5279fd2, but Ubuntu reports no vendor-supplied pa...

CVE-2023-24287

Portable Puzzle Collection (sgt-puzzles) versions before 20230116.5782e29 contain a buffer overflow in the Undead puzzle , triggerable via the "M" command when loading a crafted save file. The vulnerability results in a low availability impact (CVSS 3.1 base score 2.9 , local attack vector with h...

CVE-2026-59960: Improper Neutralization of Special Elements used in an OS Command

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...