CVE-2026-110262

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in...

CVE-2026-100229

A flaw was found in GStreamer's H.266 codec parser library libgstcodecparsers. An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly accepted, causing the parser to write beyond the bounds of an internal structure. An attacker could...

CVE-2026-109149

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not...

RHEL 9 : rpcbind (RHSA-2026:83562)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:83562 advisory. The rpcbind utility is a server that converts Remote Procedure Call RPC program numbers into universal addresses. It must be running on the host to ...

Linux Distros Unpatched Vulnerability : CVE-2026-110832

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wtsreaddrdynvcdatafirst that allows authenticated clients to force servers to...

Oracle Linux 10 : rpcbind (ELSA-2026-83561)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-83561 advisory. 1.2.7-3.1 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics...

PT-2026-115318

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description Memory corruption occurs in the SVG component, which allows a remote attacker to read memory by inducing the user to visit a specially crafted HTML page. Recommendations Update Google...

PT-2026-115314

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description Memory corruption occurs in the DOM Document Object Model, which is the programming interface for HTML and XML documents. This issue allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-110736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader core/string/optimizedtranslation.cpp, OptimizedTranslation::getmessage...

Unity Linux 20.1070e Security Update: ruby (UTSA-2026-130360)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130360 advisory. An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.getclass, Resolv::DNS::Resource::Generic.create, and...

RHEL 9 : ruby (RHSA-2026:83574)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83574 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

RHEL 8 : rpcbind (RHSA-2026:83563)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:83563 advisory. The rpcbind utility is a server that converts Remote Procedure Call RPC program numbers into universal addresses. It must be running on the host to ...

Linux Distros Unpatched Vulnerability : CVE-2026-110833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can...

Linux Distros Unpatched Vulnerability : CVE-2026-110927

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand past the maximum supported packet size because the inflate loop do...

Rocky Linux 10.2 [CIQ] Security Update: pcre2 / pcre2-debuginfo / pcre2-debugsource / pcre2-devel / etc Multiple Vulnerabilities (crlsa-2026_81522)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202681522 advisory. pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions CVE-2026-86145 PCRE2: PCRE2: Out-of-bounds read via...

RHEL 9 : ruby (RHSA-2026:83571)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83571 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

PT-2026-114834

In Eclipse Vert.x versions 4.0.0, 4.5.34 or 5.0.0,5.0.12 or 5.1.0,5.1.9 or 5.2.0, 5.2.0, the PostgreSQL message decoder reads the 4-byte message length field from the PostgreSQL wire protocol without any maximum validation. A malicious, compromised, or man-in-the-middle PostgreSQL server can send...

PT-2026-115160

libTiMidity through 0.2.8 contains a stack out-of-bounds write vulnerability in the SoundFont loader that allows attackers to corrupt stack memory via unchecked generator operators in parse gen. Attackers can supply a crafted .sf2 file with out-of-range pgen/igen operator values to write chosen...

Stable Channel Update for Desktop

The Stable channel has been updated to 155.0.8059.84/.85 for Windows and Mac and 155.0.8059.84 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

Important: rpcbind security update

The rpcbind utility is a server that converts Remote Procedure Call RPC program numbers into universal addresses. It must be running on the host to be able to make RPC calls on a server on that machine. Security Fixes: rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows...