CVE-2025-49113

CVE-2025-49113 Roundcube Exploit A Python exploit for CVE-2025-49113, targeting a vulnerability in Roundcube webmail that allows remote code execution through PHP object deserialization. Overview This exploit leverages a deserialization vulnerability in Roundcube's file upload functionality. It...

VulnCheck KEV: CVE-2026-96656

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

VulnCheck KEV: CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 External Control of File Name, leading to the root architectural issue within LocalStorageService remaining unresolved. Because the underlying...

PT-2026-116901

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifs file copychunk range and the clone FICLONE path of cifs remap file range do not serialise the destination page cache against the server-side copy the way the...

CVE-2026-98777: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98778: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

Linux Distros Unpatched Vulnerability : CVE-2026-98778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer i...

CVE-2026-112059: Out-of-bounds Write

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

Linux Distros Unpatched Vulnerability : CVE-2026-98682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the...

Linux Distros Unpatched Vulnerability : CVE-2026-98685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: discard post-EOF pagecache when extending a file via clone range cifsremapfilerange discarded the pagecache only for the folios overlapping the...

PT-2026-117160

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the...

PT-2026-116905

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3 zero range removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold dat...

PT-2026-116904

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via clone range cifs remap file range discarded the pagecache only for the folios overlapping the destination region, so when a clone extends the file the folio...

CVE-2026-98682: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

Linux Distros Unpatched Vulnerability : CVE-2026-98686

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it...

Linux Distros Unpatched Vulnerability : CVE-2026-98777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791972286)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791972286 advisory. - rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who c...

PT-2026-116772

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofs kill sb When autofs fill super fails before clearing AUTOFS SBI CATATONIC for example, when find get pid fails on an invalid pgrp mount option, or when an fs context is closed...

PT-2026-116642

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

Security update for gimp (important)

openSUSE security update: security update for gimp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22123-1 Rating: important References: bsc1277594 bsc1277618 bsc1277622 bsc1284473 bsc1284474 bsc1284475 Cross-References: CVE-2026-106061...