PT-2026-77010

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description An integer overflow occurs within the Graphics component. An integer overflow is a condition...

Fixed in Apache Tomcat 11.0.25

Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...

Linux Distros Unpatched Vulnerability : CVE-2026-72169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - kho: make sure scratch size is always aligned by CMAMINALIGNMENTBYTES When using scratchscale, the scratch sizes are rounded up to CMAMINALIGNMENTBYTES since th...

Linux Distros Unpatched Vulnerability : CVE-2026-72244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu/buddy: bail out of tryharder when alignment cannot be honoured The tryharder contiguous fallback could return a range whose start offset did not match the...

Linux Distros Unpatched Vulnerability : CVE-2026-72357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uprobes/x86: Use proper mmstruct in inuprobetrampoline In the unregister path we use inuprobetrampoline check with current-mm for the VMA lookup, which is wrong...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox...

Linux Distros Unpatched Vulnerability : CVE-2026-72180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd rewrites a writable device-private PMD swap entry into a readable o...

RHEL 9 : kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_126_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 (RHSA-2026:56224)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56224 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...

Linux Distros Unpatched Vulnerability : CVE-2026-72224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: Free arenas on bttinit error paths The arenas allocated by discoverarenas or createarenas are not freed on some error paths in bttinit. This leaks...

Linux Distros Unpatched Vulnerability : CVE-2026-72435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment...

Linux Distros Unpatched Vulnerability : CVE-2026-72026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If...

Linux Distros Unpatched Vulnerability : CVE-2026-72251

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote Windows host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,...

Linux Distros Unpatched Vulnerability : CVE-2026-72088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the...

Linux Distros Unpatched Vulnerability : CVE-2026-72264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: tridentfb: fix potential memory leak in tridentpciprobe In tridentpciprobe, the memory allocated for modelist using fbvideomodetomodelist is not freed in...

Linux Distros Unpatched Vulnerability : CVE-2026-72259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: mediatek: mt8192: Release reserved memory on cleanup The MT8192 AFE probe calls ofreservedmemdeviceinit and falls back to preallocated buffers when no...

Linux Distros Unpatched Vulnerability : CVE-2026-72457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fail policy unpack on accept2 allocation failure unpackpdb may need to allocate a missing ACCEPT2 table for older policy data. If that allocation...

Linux Distros Unpatched Vulnerability : CVE-2026-72272

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: radeon: fix potential memory leak in radeonfbpciregister The function radeonfbpciregister allocates memory for modelist by calling radeoncheckmodes which...

Linux Distros Unpatched Vulnerability : CVE-2026-72102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmearlycreate: fix freeing used table on dmresume failure If dmresume fails, the kernel attempts to free table with dmtabledestroy, but the table was already...