Linux Distros Unpatched Vulnerability : CVE-2026-18705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different,...

RHEL 9 : libXfont2 (RHSA-2026:61390)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61390 advisory. X.Org X11 libXfont2 runtime library Security Fixes: libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679...

RHEL 9 : nodejs:24 (RHSA-2026:61386)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61386 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

RHEL 9 : pipewire (RHSA-2026:61768)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61768 advisory. PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fixes: pipewire: PipeWire: Sandbox escape and arbitrary co...

Amazon Linux 2023 : dracut, dracut-caps, dracut-config-generic (ALAS2023-2026-2085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2085 advisory. A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message...

RHEL 10 : nodejs22 (RHSA-2026:61376)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61376 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

RHEL 10 : gzip (RHSA-2026:61625)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61625 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...

SUSE SLED15 / SLES15 Security Update : go1.27 (SUSE-SU-2026:3830-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3830-1 advisory. - go1.27.0 released 2026-08-19 is a major release of Go. go1.27.x minor releases will be provided through Augu...

ALSA-2026:61355 Moderate: dbus-broker security update

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features...

Important: golang

Issue Overview: Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client...

RHEL 9 : pam (RHSA-2026:61226)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61226 advisory. Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle...

(0Day) pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...

PT-2026-83967

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...

CVE-2026-82623

A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UADataValuebackendcopyRange of the file plugins/historydata/uahistorydatabackendmemory.c of the component History Backend. The manipulation results in use after free. The attack can be launched...

PT-2026-84041

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the preview-link endpoint and the src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php file where VIEW permissions are not enforced f...

PT-2026-83957

A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amf object get of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly...

PT-2026-83942

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint handler updateSystemConfig performs no authorization check. It is...

PT-2026-83943

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

PT-2026-83944

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' or 'custom' is used against a group route,...

PT-2026-83679

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash admin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decode primary key/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as...