Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001364 advisory. The spectrev2selectmitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1 does not always fill RSB upon a context switch, which makes it...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003941)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003941 advisory. Incomplete cleanup from specific special register read operations in some IntelR Processors may allow an authenticated user to potentially enable information...

MiracleLinux 7 : libvirt-3.9.0-14.el7.4 (AXSA:2018-3092:06)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3092:06 advisory. libvirt: Resource exhaustion via qemuMonitorIORead method CVE-2018-5748 libvirt: Incomplete fix for CVE-2018-5748 triggered by QEMU guest agent...

CVE-2026-22864 Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.5.6, a prior patch aimed to block spawning Windows batch/shell files by returning an error when a spawned path’s extension matched .bat or .cmd. That check performs a case-sensitive comparison against lowercase literals and...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003320)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003320 advisory. In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket. This issue...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002354 advisory. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001857)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001857 advisory. The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNELDS option is set, which allows local...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003479 advisory. Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain privileges via a crafted application that makes concurrent...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001986)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001986 advisory. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002038)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002038 advisory. Race condition in the rdssendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service NULL pointer...

Pimcore Has an Incomplete Patch for CVE-2023-30848

Summary An incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments -- and catching syntax errors, the fix is insufficient. Attackers can still...

GHSA-QVR7-7G55-69XJ Pimcore Has an Incomplete Patch for CVE-2023-30848

Summary An incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments -- and catching syntax errors, the fix is insufficient. Attackers can still...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

CVE-2026-23492

Pimcore Admin Search Find API exposes blind SQL injection due to an incomplete patch from CVE-2023-30848. Affected versions: Pimcore before 12.3.1 and before 11.5.14. Attack requires authenticated access to the admin interface and can disclose database information via blind SQL injection, potenti...

CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL...

kernel: RDMA/rxe: Fix incomplete state save in rxe_requester

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe soft-RoCE driver in the requester packet transmission logic. A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue eleme...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001187)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001187 advisory. The simplesetacl function in fs/posixacl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allow...

MiracleLinux 9 : tomcat-9.0.87-3.el9_6.1 (AXSA:2025-10690:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2025-10690:04 advisory. tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation CVE-2024-56337 tomcat: Apache Tomcat: DoS via malformed HTTP...

Atlassian Confluence 7.19.0 < 8.5.20 / 8.6.x < 9.2.6 / 9.3.x < 9.3.1 / 9.4.0 / 9.5.x < 9.5.2 / 10.0.x < 10.0.2 / 10.1.0 / 10.2.0 (CONFSERVER-101489)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101489 advisory. - The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and...