PT-2026-110345

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

PT-2026-110228

Name of the Vulnerable Software and Affected Versions ZephyrProject Zephyr affected versions not specified Description An issue exists in the Bluetooth LE host where received L2CAP connection-oriented channel CoC data is queued for deferred processing using a k work structure embedded in the...

PT-2026-110170

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search...

PT-2026-110173

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...

PT-2026-110111

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc add gchord of the file src/load abc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor wa...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1791735799)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791735799 advisory. - In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers,...

PT-2026-110346

Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables. This issue affects rlottie: e57b094f03c39a751a1fded6f7d6c13f1ed95ec9...

PT-2026-110341

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface: versions before 11.2...

PT-2026-110343

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1791735057)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791735057 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write...

Linux Distros Unpatched Vulnerability : CVE-2026-41691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without...

PT-2026-110186

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1791735057)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791735057 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to writ...

MiracleLinux 8 : perl-DBI:1.641 perl-DBI-1.641-10.module+el8+2048+32bd5070 (AXSA:2026-2012:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2012:01 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block...

MiracleLinux 8 : perl-DBI:1.641 perl-DBI-1.641-10.module+el8+2048+e84ee65f (AXSA:2026-2013:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2013:01 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block...

PT-2026-110036

Name of the Vulnerable Software and Affected Versions Freeton WP versions prior to 1.0.1 Description The plugin fails to correctly validate the activation code during user authentication. This allows unauthenticated attackers to log in as any user, including administrators, provided they know the...

PT-2026-110338

Name of the Vulnerable Software and Affected Versions Linksys E1700 version 1.0.0.4.003 Description A stack-based buffer overflow occurs in the Mac Filter component when processing the newap text %d argument within the ssid1MACFilter function of the /goform/ssid1MACFilter endpoint. This issue...

PT-2026-110339

Name of the Vulnerable Software and Affected Versions Linksys E1700 versions prior to 1.0.0.4.003 Description A stack-based buffer overflow occurs when the setVlan function in the /goform/setVlan endpoint is manipulated via the vlan set argument. This issue allows for remote attacks...

PT-2026-110349

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched...

PT-2026-110073

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This manipulation of the argument filename causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclos...