PT-2026-82915

In the Linux kernel, the following vulnerability has been resolved: net: dst metadata: fix false-positive memcpy overflow in tun dst unclone kmalloc flex in metadata dst alloc sets counted by for the structure to the options len, which is then initialized to zero. Later, we're initializing the...

PT-2026-83123

Name of the Vulnerable Software and Affected Versions grpc-gateway version 2.28.0 Description Incorrect Access Control occurs because the application processes the X-HTTP-Method-Override header in the ServeMux.ServeHTTP function without restricting allowed methods. When a POST request with...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:21663-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21663-1 advisory. Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: log4j12 (UTSA-2026-093019)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093019 advisory. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: ibus (UTSA-2026-031617)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031617 advisory. A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a...

Spring Framework 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

The version of Spring Framework installed on the remote host is 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple vulnerabilities: - UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cyrus-sasl (UTSA-2025-002280)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002280 advisory. In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. Tenable has extracted the precedi...

Linux Distros Unpatched Vulnerability : CVE-2026-59189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In OpenEXRUtil versions 3.3.0...

Opera bug bounty: How vulnerability research is evolving with AI

Security Opera bug bounty: How vulnerability research is evolving with AI Share August 28th, 2026 Hi Opera users! Browser security is constantly evolving, and so are the ways vulnerabilities are discovered. At Opera, we heavily invest in securing our products and services through the efforts of o...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wayland (UTSA-2025-002252)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002252 advisory. An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on...

CVE-2026-37736

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. The vulnerability is rated CVSS 3.1: 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning it is network-exploitable with n...

PT-2026-83243

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo admin/endpoints.py uses superuser validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session...

PT-2026-82932

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996 init tx queues When MT76 NPU and CONFIG NET MEDIATEK SOC WED are enabled and mt76 detects properly the Airoha NPU SoC, mt7996 init tx queues will dereference a NULL WED...

PT-2026-83175

An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache...

PT-2026-83116

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user'...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: libass (UTSA-2026-032348)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-032348 advisory. In libass 0.14.0, the assoutlineconstruct's call to outlinestroke causes a signed integer overflow. Tenable has extracted the preceding description block directly fr...

AlmaLinux 10 : assertj-core (ALSA-2026:59372)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59372 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description block...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: cryptsetup (UTSA-2026-030644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030644 advisory. It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical acces...

openSUSE 16: pyenv / pyenv-bash-completion / pyenv-fish-completion / etc (openSUSE-SU-2026:21664-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21664-1 advisory. Changes in pyenv: - CVE-2026-68939: a matching attacker-controlled file can silently select a different installed interpreter or version bsc1275661...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtirpc (UTSA-2025-002260)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002260 advisory. In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This ca...