PT-2026-120545

An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC versions 1.11.0 through 1.17.0 on all platforms. A client that creates multiple streams in a single RPC expects the server response to carry exactly one extra stream id for every additional stream. The response...

PT-2026-120608

WarehousePG WHPG 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability CWE-862 in the built-in function gp log backend memory contexts. Any authenticated database role can run this function without a GRANT. It also gets around the superuser restriction that PostgreSQL places on...

PT-2026-120546

Unbounded memory accumulation in the stream message reassembly path of Apache bRPC version 1.18.0 on all platforms allows remote attackers to exhaust the memory of a server denial of service by sending an endless sequence of continuation data frames. Root Cause: The streaming RPC protocol bounds...

WebGL DoS

The vulnerability of WebGL interfaces in Google Chrome and Microsoft Edge relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-113288

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-79609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XPTI Xen Page Table Isolation was introduced to mitigate Meltdown CVE-2017-5754, one aspect of XSA-254. This involves copying 64-bit PV guest page table entries...

Linux Distros Unpatched Vulnerability : CVE-2026-113243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-113066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Fonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromium...

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fixes:...

Linux Distros Unpatched Vulnerability : CVE-2026-113340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-94300

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Replaying GSS-TSIG signed UDP messages can result in memory corruption in named. An attacker who can capture a previously signed UDP message can replay it while...

Debian dla-4848 : libapache2-mod-php8.2 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4848 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4848-1 [email protected]...

Debian dsa-6574 : libapache2-mod-php8.4 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6574 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6574-1 [email protected] https://www.debian.org/securit...

ALSA-2026:87071 Important: php8.4 security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

ALSA-2026:87151 Important: php security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error...

PHP Vulnerability: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP Vulnerability: CVE-2026-109618

PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may re...

PHP2Shell RCE vulnerabilities that can allow unauthenticated remote code execution (CVE-2026-109618, CVE-2026-109619)

The Brocade Product Security Team has become aware of two memory-safety vulnerabilities stemming from improper handling of fatal errors, specifically out-of-memory errors, during request processing in PHP. When a request terminates unexpectedly due to these errors, the internal PHP state can beco...

RockyLinux 10 : php (RLSA-2026:87070)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:87070 advisory. php: php: Denial of Service via unbounded recursion in SOAP parser CVE-2026-91765 php: OOM bailout during request parsing leads to memory corruption an...

Linux Distros Unpatched Vulnerability : CVE-2026-113110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...