CVE-2026-95271: Improper Authentication

A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function checkauthentication of the file changedetectionio/flaskapp.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from...

CVE-2026-88339

A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone function of GPAC 2d7da22e 26.08-DEV. The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition,...

EUVD-2026-84850

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

CVE-2026-88341

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can provide a malicious file with an invalid arena configuration numbuffers=0 that triggers an assertion failure in yrarenagetptr, causing the application to terminate...

openssh security update

9.9p1-11.0.1 - Restore pamsshagentrel values that were used for initial release - Fix PerSourcePenalties grace-exceeded using the crash penalty value Orabug: 39825354 - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el102 ML-KEM/NIST backport Orabug: 39423076 - Upstream...

CVE-2026-63278: Exposure of Sensitive Information to an Unauthorized Actor

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

ROS-20260922-73-0097

The vulnerability of the dpsdpmessagedebugfswrite function in the drivers/gpu/drm/amd/display/amdgpudm/amdgpudmdebugfs.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to the copying of buffers without checking the size of the...

ROS-20260922-73-0066

The vulnerability of the dw8250probe function in the drivers/tty/serial/8250/8250dw.c file of the console TTY driver in the Linux kernel’s parallel port is related to the assignment of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to compromise the...

VulnCheck KEV: CVE-2026-87902

An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ntp (UTSA-2026-090102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090102 advisory. ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service memory consumption by sending packets, because memory...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: raptor2 (UTSA-2026-054035)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054035 advisory. A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon. Tenable has extracted the preceding...

The vulnerability in the `defaultSandboxPrepareStackTrace` function of the `lib/setup-sandbox.js` file in the `vm2` library of the NPM package manager allows a attacker to compromise the integrity of protected information.

The vulnerability of the defaultSandboxPrepareStackTrace function in the lib/setup-sandbox.js file of the vm2 library, a part of the npm package manager, is related to a data protection mechanism flaw. Exploiting this vulnerability could allow an attacker to compromise the integrity of the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: poppler (UTSA-2023-002397)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002397 advisory. In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service application crashes with SIGABRT by crafting a PDF file in which th...

FreeBSD : p5-Dancer2 -- Multiple vulnerabilities (5e6fe0cf-b655-11f1-ad2b-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5e6fe0cf-b655-11f1-ad2b-40b034429ecf advisory. Dancer project reports: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2023-000319)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000319 advisory. Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a...

RHEL 7 : gstreamer1-plugins-base (RHSA-2026:69866)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69866 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

Vendor-signed UEFI Shell applications allow Secure Boot bypass

Overview Vendor-signed UEFI Shell applications may allow an attacker to bypass Secure Boot protections by abusing commands such as mm Memory Modify. On systems that trust the affected vendor’s certificate or include the application’s Authenticode hash in the UEFI Authorized Signature Database DB,...

CVE-2026-25262: Write-what-where Condition

Memory corruption while processing a crafted ELF file in the Primary Bootloader...

RockyLinux 8 : openssh (RLSA-2026:69266)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69266 advisory. openssh: OpenSSH: sftp client allows attacker to control downloaded file location CVE-2026-59995 openssh: OpenSSH sshd: Security bypass due to incorrect...

Linux Distros Unpatched Vulnerability : CVE-2026-93712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the...