UBUNTU-CVE-2026-68555

Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TURN user can repeatedly resume one allocation from fresh UDP 5-tuples without completing a handoff when the server enables --mobility. mobilebegintransition in src/server/nsturnserver.c disarms each...

PT-2026-79272

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...

PT-2026-80729

A security issue was discovered in the Linux kernel. An attacker could possibly use this to compromise the system. This update corrects flaws in the following subsystems: - Open vSwitch;...

PT-2026-79328

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service CKS plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to versi...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102020)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102020 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels seg6inputcore and rplinput call...

RockyLinux 10 : kernel (RLSA-2026:57251)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57251 advisory. kernel: drm/amdkfd: Fix out-of-bounds write in kfdeventpageset CVE-2026-43206 kernel: drm/amdgpu: Refactor amdgpugemvaioctl for Handling Last Fence...

openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21594-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21594-1 advisory. Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-76 bsc1274867 CVE-2026-74934: Site isolation issue in the Graphics:...

RockyLinux 8 : curl (RLSA-2026:57462)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57462 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of Rocky Linux-73788. The .9...

AlmaLinux 8 : curl (ALSA-2026:57462)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57462 advisory. curl: curl: Insecure connection establishment due to TLS configuration mismatch CVE-2026-8286 Bug Fixes and Enhancements: Regression of AlmaLinux-73788. The .9...

Kibana 9.4.x < 9.4.4 Privilege Escalation (ESA-2026-83)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-83 advisory. - Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature...

CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

PT-2026-79481

Name of the Vulnerable Software and Affected Versions xShop version 3.0.3 Description An unrestricted file upload flaw exists in this open-source shop developed in Laravel. The issue stems from insufficient validation of uploaded files, allowing an authenticated administrator to upload executable...

PT-2026-79415

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote variables loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destinati...

PT-2026-79425

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

PT-2026-79431

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceController/FlwDefinitionController/FlwCategoryController/FlwSpelController/TestLeaveController of the component Workflow Endpoint. Such manipulation leads to improper authorization. Th...

PT-2026-79488

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct...

PT-2026-79426

Missing queue-set type validation in xQueueAddToSet in the FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports with configUSE QUEUE SETS=1 to read privileged kernel memory. To remediate this issue, users should upgrade to version 11.3.1 or later...

PT-2026-79420

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to 3.9.1, the public POST /api/v1/auth/register route in server/src/api/routes/authRoutes.ts passes multipart...

PT-2026-79315

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache CloudStack's NAS backup provider plugin. The addBackupRepository API available since 4.20.0.0 and updateBackupRepository API introduced in 4.22.0.0 accept unsanitized command options f...

PT-2026-79427

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...