Linux Distros Unpatched Vulnerability : CVE-2026-101015

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the componen...

TencentOS Server 4: tomcat (TSSA-2026:1064)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1064 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CentOS Linux 6 [TuxCare] Security Update: libsss_idmap / libsss_simpleifp / python-sss / python-sss-murmur / etc (CENTOS6:CLSA-2025:1748947069)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1748947069 advisory. - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...

CentOS Linux 7 [TuxCare] Security Update: libsss_idmap / libsss_simpleifp / libsss_simpleifp-devel / etc (CENTOS7:CLSA-2025:1748967240)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1748967240 advisory. - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...

PT-2026-103306

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.18991 Description Improper access control on the Gantt chart allows users with view-only permissions to perform edits. Recommendations Update to version 2026.2.18991...

PT-2026-103011

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows an attacker with local access to escalate privileges to root. Exploitation requires an attacker to be able to run arbitrary code on a node by eithe...

CVE-2026-62084: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810...

CVE-2026-75824: Improper Access Control

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role...

ROS-20260930-73-0045

The vulnerability of the nfs4ffallocdeviceidnode function in the fs/nfs/flexfilelayout/flexfilelayoutdev.c module, which is part of the NFS client support in Linux operating systems, is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause servic...

CVE-2026-93995

Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though class GitPgmCommandFactory a way to configure an Apache MINA SSHD...

ROS-20260930-73-0041

The vulnerability of the gsusbreceivebulkcallback function in the drivers/net/can/usb/gsusb.c file of the Linux network device driver module is related to improper memory release. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-96824: Improper Limitation of a Pathname to a Restricted Directory

Editor Arbitrary File Deletion in Template Kit – Import = 1.0.16 versions...

CVE-2026-47562: Improper Encoding or Escaping of Output

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted text into the kernel log because the supplied version string is not properly sanitized. A successful exploit of this vulnerability might lead to denial of service and data...

CVE-2026-93547: Improper Authorization

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist y...

CVE-2026-102106: Improper Authentication

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid...

CVE-2026-102132: Improper Access Control

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system...

CVE-2026-88797: Improper Access Control

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository...

CVE-2026-86556: Improper Privilege Management

There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to obtain relevant information...

CVE-2026-103108: Reachable Assertion

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service...

CVE-2026-103104: Reachable Assertion

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service...