Linux Distros Unpatched Vulnerability : CVE-2026-111134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792142544)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792142544 advisory. - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to...

CVE-2026-109219: Unrestricted Upload of File with Dangerous Type

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the extension allowlist applied only...

UBUNTU-CVE-2026-111458

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

PT-2026-116034

🚨 CVE-2026-111635 Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an...

PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

PT-2026-115443

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.8 Description Insufficient file type validation occurs when saving IMAP email attachments through the initMailPart function. This allows unauthenticated attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-111148

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an...

RockyLinux 8 : lrzsz (RLSA-2026:83525)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83525 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

PT-2026-115923

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115650

Name of the Vulnerable Software and Affected Versions lomiri-download-manager affected versions not specified Description An incorrect DBus policy in the lomiri-upload-manager component of lomiri-download-manager allows an arbitrary user to read arbitrary files with root privileges over DBus. DBu...

PT-2026-116177

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

CVE-2026-102740

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path...

UBUNTU-CVE-2026-110877

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

PT-2026-116135

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution...

PT-2026-115652

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

MiracleLinux 8 : lrzsz-0.12.20-46.el8_10 (AXSA:2026-2077:01)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2077:01 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Linux Distros Unpatched Vulnerability : CVE-2026-110717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside...

CVE-2026-111385: URL Redirection to Untrusted Site

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

Linux Distros Unpatched Vulnerability : CVE-2026-104715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet...