RHEL 9 : glibc (RHSA-2026:79281)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:79281 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name...

RHEL 9 : rhc (RHSA-2026:79012)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:79012 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security Fixes:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libXi (UTSA-2026-142333)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142333 advisory. An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. Tenable has extracted the...

PT-2026-120553

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 22.23.4 Node.js versions prior to 24.22.1 Node.js versions prior to 26.12.1 Node.js versions 18.x and 20.x Description Ten security flaws were identified, including four high-severity issues. A critical flaw in the...

PT-2026-120711

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software affected versions not specified Description An issue exists in the IPv4 packet processing functionality affecting Cisco ASR 9000 and 9900 Series Aggregation Services Routers, and Cisco ASR 9902 and 9903 Compact...

PT-2026-120688

Name of the Vulnerable Software and Affected Versions Snort 3 affected versions not specified Description An issue exists involving uncontrolled resource consumption, which occurs when an application does not properly limit the amount of resources it consumes, potentially leading to a denial of...

ALSA-2026:86921 Important: librsvg2 security update

The librsvg2 packages provide a Scalable Vector Graphics SVG library based on the libart library. Security Fixes: librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 For more details about the security issues, including the impact, a CVSS score,...

RHEL 9 : kpatch-patch-5_14_0-687_10_1 and kpatch-patch-5_14_0-687_42_1 (RHSA-2026:81452)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:81452 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Unity Linux 20.1070a Security Update: libXpm (UTSA-2026-141774)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141774 advisory. A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows a local attacker to trigger an...

PT-2026-120823

Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode in src/libImaging/JpegEncode.c can call jpeg write marker for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free in buffe...

PT-2026-120819

Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/ imaging.c checks positive glyph advances against INT MAX but does not check negative advances against INT MIN. Repeating a signed 16-bit advance of -32768 can therefore execute a signed C integer overflow...

PT-2026-120812

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse repeatedly slices and rejoins every path prefix in lib/compiler.js while processing long dotted keys, table headers, array-of-tables headers, and inline-table keys in assign, deepRef, and setNestedKey. The resultin...

PT-2026-120822

Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using...

PT-2026-120820

Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consum...

PT-2026-120811

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse can write attacker-controlled properties to Object.prototype because quoteDottedString in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray to clear another...

PT-2026-120816

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output path causes file inclusion...

PT-2026-120807

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of the file internal/handlers/editor.go of the component API. Executing a manipulation can lead to path traversal. The attack can be launched remotely. T...

PT-2026-120805

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

PT-2026-120808

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

PT-2026-120897

============================================================================ Memory disclosure and segfault in libtiff encoder via crafted TIFF tags Location: src/encode.c:1014 in PyImaging LibTiffEncoderNew Commit: a707c6b21c313880d0771e54965d142dd42358b6...