Linux Distros Unpatched Vulnerability : CVE-2026-72173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/proc/taskmmu: do not warn on seeing non-migration pmd entry Patch series mm/hmm: A fix and a selftest, v3. Patch 1 fixes a stale warning present from the tim...

Oracle Linux 9 : nodejs:24 (ELSA-2026-55603)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55603 advisory. - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257...

RockyLinux 10 : nodejs22 (RLSA-2026:55541)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55541 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 brace-expansion: brace-expansion: Denial of...

Linux Distros Unpatched Vulnerability : CVE-2026-72039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bnx2x: fix potential memory leak in bnx2xallocmembp If the allocation of fpi.tpainfo fails, the error path will not free the struct bnx2xfastpath allocated...

Linux Distros Unpatched Vulnerability : CVE-2026-72475

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmaengine: dma-axi-dmac: Properly free struct axidmacdesc Use axidmacfreedesc to free fully the descriptor at fail path when call axidmacallocdesc in...

Linux Distros Unpatched Vulnerability : CVE-2026-72251

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a...

Linux Distros Unpatched Vulnerability : CVE-2026-72230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: frag: free unfragmentable packet The caller of batadvfragsendpacket assume that the skb provided to the function are always consumed. But the...

Amazon Linux 2023 : wget (ALAS2023-2026-2047)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2047 advisory. GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memo...

Linux Distros Unpatched Vulnerability : CVE-2026-72435

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment...

Linux Distros Unpatched Vulnerability : CVE-2026-72026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - irqchip/irq-riscv-imsic-early: Fix fwnode leak on state setup failure imsicearlyacpiinit allocates a firmware node before setting up the IMSIC state. If...

Amazon Linux 2023 : jackson-core (ALAS2023-2026-2067)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2067 advisory. The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit...

Linux Distros Unpatched Vulnerability : CVE-2026-72088

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If physdisk-inreset is set, the function returns directly without undoing the resources acquired for the...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote Windows host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14,...

Linux Distros Unpatched Vulnerability : CVE-2026-72102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dmearlycreate: fix freeing used table on dmresume failure If dmresume fails, the kernel attempts to free table with dmtabledestroy, but the table was already...

Amazon Linux 2023 : javapackages-bootstrap (ALAS2023-2026-2055)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2055 advisory. Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core 5.4.2 and earlier, 5.5-beta1 and earlier allows an remote attacker to cause a denial of...

Security Vulnerabilities fixed in Thunderbird 140.14 — Mozilla

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs...

PT-2026-76976

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 115.39 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to...

Security Vulnerabilities fixed in Firefox ESR 115.39 — Mozilla

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited...

Linux Distros Unpatched Vulnerability : CVE-2026-59902

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox...