Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: sctp: purge outqueue on stale COOKIE-ECHO handling CVE-2026-52924 kernel: scsi: target: iscsi: Validate CHAPR length before base64...

Linux Distros Unpatched Vulnerability : CVE-2026-79084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to...

Linux Distros Unpatched Vulnerability : CVE-2026-78943

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged...

Linux Distros Unpatched Vulnerability : CVE-2026-78979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy...

Linux Distros Unpatched Vulnerability : CVE-2026-79017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted Chrome...

Linux Distros Unpatched Vulnerability : CVE-2026-79243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proces...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: fwupd (UTSA-2026-054034)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054034 advisory. A PGP signature bypass flaw was found in fwupd all versions, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is...

Linux Distros Unpatched Vulnerability : CVE-2026-79085

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin...

PT-2026-82233

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Description An application using WebAuthn support may be vulnerable to user...

PT-2026-81931

Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL Scheme CWE-939. A malicious application installed on the user's Android device may exploit the affected application's functionality through an Intent, potentially allowing arbitrary JavaScript to be...

PT-2026-82072

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances...

PT-2026-82261

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

CVE-2026-75331

tamguo 1.5.3 is affected by an Unrestricted File Upload vulnerability that leads to Stored XSS . The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java lack file type validation, allowing authenticated attackers to upload arbitrary HTML or JavaScript file...

PT-2026-82269

Name of the Vulnerable Software and Affected Versions PayRange API affected versions not specified Description The PayRange API lacks proper authorization on management endpoints, allowing public access to verbose details of every device on the network, regardless of whether the requester has an...

PT-2026-82292

This is a classic "roundup" post. Since the summary is generic "top threats you should know about" and the source is a vendor F5, I need to assume this is a curated list of multiple events. I will treat this as Scenario A Technical Threat but structure it as a digest of multiple items, pulling fr...

PT-2026-82067

Name of the Vulnerable Software and Affected Versions TarsWeb versions prior to 3.0.16 Description TarsWeb incorrectly determines if a request originates from a trusted local caller by relying on a client-controlled header. The app.js file enables the Koa proxy option without specifying trusted...

PT-2026-82321

Name of the Vulnerable Software and Affected Versions tamguo version 1.5.3 Description An unrestricted file upload issue allows for stored Cross-Site Scripting XSS, a technique where malicious scripts are permanently stored on the target server. The '/uploadFile' and '/imgUpload' endpoints within...

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

The DXPR Builder module provides a visual / AI page builder for Drupal. The module uses a JSON Web Token for licensing, user license management, AI services, and subscription metadata. The 2.x version of the module does not sufficiently restrict access to API credentials in JavaScript settings...

Blazy - Less critical - Access bypass - SA-CONTRIB-2026-104

This module enables users to display a field of a target entity through a Blazy Filter plugin shortcode. The module does not consistently check entity view access. If a user has access to a Blazy-enabled text format, this allows them to render a field from an entity they are not permitted to view...

PT-2026-82077

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin on the acting account rather than verifying whether the specific API key carri...