PHP 8.1 FPM Memory Corruption Fixes

PHP versions 5.0 through 8.1 contain memory-state corruption flaws that can lead to remote code execution. This release provides backported patches, Dockerfiles, and validation tools for PHP-FPM and related images...

PT-2026-121510

Name of the Vulnerable Software and Affected Versions msgpack-python versions prior to 1.2.3 Description The msgpack-python C extension msgpack. cmsgpack leaks a decoded map value during deserialization when a key is rejected while strict map key is set to True. This can lead to unbounded process...

PT-2026-135074

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack. cmsgpack leaks a decoded map value when deserialization rejects a key with strict map key=True the default. Repeated malformed inputs can cause unbounded process memory...

RHEL 9 : php (RHSA-2026:87151)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87151 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via...

PHP 5.3.29 php2shell Backport

An unofficial backport for PHP version 5.3.29 applies fixes for out-of-memory bailout and stale request-state vulnerabilities affecting Apache modphp...

PHP 5.3.29 / 5.4.16 / 7.3.33 Remote Code Execution

PHP versions 5.3.29, 5.4.16, and 7.3.33 backport minimal mitigations for remote code execution issues caused by out-of-memory corruption and stale global state...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in affected interfaces. Unauthenticated neighboring attackers can exploit this vulnerability to achieve remote code execution, allowing arbitrary code to be executed by the underlying operating system as a...

Linux Distros Unpatched Vulnerability : CVE-2026-96644

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_87080)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202687080 advisory. php: php: Out-of-bounds read via empty HTTP redirect Location header CVE-2026-93682 php: PHP: Archive entry injection via integer overflow in TAR parser...

Linux Distros Unpatched Vulnerability : CVE-2026-96636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek and DcxImageFile.seek reparse later MPO or DCX frames and replace self.size without...

PHP 8.0.30-6 Out-Of-Memory Remote Code Execution

PHP version 8.0.30-6 on EL7 Remi builds is vulnerable to out-of-memory state corruption that can lead to remote code execution. This submission provides a backported mitigation and a Docker proof of concept demonstrating affected session upload progress, local file inclusion, and OOM behavior...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142714)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142714 advisory. In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory...

SUSE SLES12 Security Update : busybox (SUSE-SU-2026:4773-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4773-1 advisory. - CVE-2026-88830: unit confusion in TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow whe...

Linux Distros Unpatched Vulnerability : CVE-2026-96637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces...

AlmaLinux 9 : openexr (ALSA-2026:86983)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86983 advisory. openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing CVE-2026-34544 openexr: OpenEXR: Denial of Service or Informati...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142713)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142713 advisory. In the Linux kernel, the following vulnerability has been resolved: IB/mad: Drop unmatched RMPP responses before reassembly Kernel-handled RMPP receive processing...

Rocky Linux 8 [CIQ] Security Update: perl-DBI / perl-DBI-debuginfo / perl-DBI-debugsource (crlsa-2026_85916)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202685916 advisory. perl-DBI: perl-DBI: Denial of Service via invalid memory read during numeric type casting CVE-2026-88815 Tenable has extracted the preceding description block...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142759 advisory. In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blkrqpayloadbytes alone Commit 25e5cb780e62 nvme-tcp: fi...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143060)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143060 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can atta...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142494)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142494 advisory. In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully...