Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. Groovy coerces a value to an interface by creating a proxy that forwards each interface method call to a method of the same name on that value...

Linux Distros Unpatched Vulnerability : CVE-2026-90019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - usb: gadget: fix null pointer dereference in usbputfunctioninstance usbputfunctioninstance attempts to dereference fd inside fi struct to get mod in uvcallocins...

SUSE SLES15 Security Update : kernel (Live Patch 58 for SUSE Linux Enterprise 15 SP4) (SUSE-SU-2026:4193-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4193-1 advisory. This update for the SUSE Linux Enterprise Kernel 5.14.21-150400.24.235 fixes various security issues: The following security issues were fixed:...

Linux Distros Unpatched Vulnerability : CVE-2026-89941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iio: buffer: Make IIO DMA fence release RCU-safe The dmafence documentation states that if a custom release implementation is provided, the dmafence object must...

Linux Distros Unpatched Vulnerability : CVE-2026-89810

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix error path at svmmigratecopytoram If page migration from device to sys ram fails for some reasons driver needs release and unlock allocated syst...

SUSE SLES15: kernel-livepatch-6_4_0-150600_23_130-default / etc (SUSE-SU-2026:4183-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4183-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150600.23.130 fixes various security issues: The following security issues were fixed: -...

Linux Distros Unpatched Vulnerability : CVE-2026-90040

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmeminvalidaterange call for SNP VMs, and use it to force vCPUs to...

Jenkins plugins Multiple Vulnerabilities (2026-09-16)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes,...

Linux Distros Unpatched Vulnerability : CVE-2026-89885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - media: platform: mtk-mdp3: Fix SCP device refcounting mdpprobe first tries to get the SCP handle with scpget. When that fails, it falls back to looking up the S...

PT-2026-93356

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

PT-2026-93294

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline local payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset...

Linux Distros Unpatched Vulnerability : CVE-2026-90003

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - futex: Prevent rcuwait use-after-free during requeue PI On PREEMPTRT, FUTEXCMPREQUEUEPI can trigger a KASAN report slab-out-of-bounds in futexrequeuepicomplete...

Linux Distros Unpatched Vulnerability : CVE-2026-89955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/vfio-ap: Fix NULL deref in statusshow during queue probe When vfioapmdevprobequeue creates the sysfs attribute group, the queue's driver data has not yet...

SUSE SLES15 Security Update : kernel RT (Live Patch 17 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4170-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4170-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.62 fixes various security issues: The following security issues were fixed: -...

PT-2026-93348

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get iodd port info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

SUSE SLES15 Security Update : kernel RT (Live Patch 19 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4168-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4168-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.72 fixes various security issues: The following security issues were fixed: -...

PT-2026-93352

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-93340

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get iodd menu info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...