Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100765)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100765 advisory. In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: webkit2gtk3 (UTSA-2026-100899)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100899 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 26.3, iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3,...

RHEL 9 : bind (RHSA-2026:55441)

"The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55441 advisory. The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named...

The vulnerability in the driver/media/PCI/CX25821/CX25821-core.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the drivers/media/pci/cx25821/cx25821-core.c component in the Linux operating system is related to improper memory release before removing the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101329 advisory. Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory...

PT-2026-73394

A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js 24.x and 22.x...

PT-2026-73396

A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

PT-2026-76688

A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management Windows deployments prior to version 26.1.2. Insufficient validation of input processed by the component may result in memory being accessed outside its intended bounds...

PT-2026-76859

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A use after free issue, which occurs when a program continues to use a pointer after it has been freed, can be exploited by a remote...

PT-2026-76840

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

PT-2026-76858

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption...

PT-2026-76838

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data...

ALSA-2026:55541 Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

PT-2026-76836

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26.6.1 iOS versions prior to 18.7.10 iPadOS versions prior to 18.7.10 iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A use-after-free issue exists in the...

PT-2026-76839

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

PT-2026-76815

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

PT-2026-76855

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash...

PT-2026-76822

Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthenticated Deskflow server can send kMsgDSetOptions DSOP values to ServerProxy::setOptions in src/lib/client/ServerProxy.cpp so that the value following a modifier option poisons m...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100740)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100740 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix missing expect put in obj eval nftctexpectobjeval allocates an expectation...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099703 advisory. In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling i...