PT-2026-117934

Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based UnsafeChunkDecoder that fails to validate back-references and literal runs. Attackers can supply crafted LZF streams to applications using the default LZFDecoder to leak unrelated JVM...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

Linux Distros Unpatched Vulnerability : CVE-2026-98621

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to...

Linux Distros Unpatched Vulnerability : CVE-2026-112395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In...

Linux Distros Unpatched Vulnerability : CVE-2026-112901

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to regular- expression denial of service. In XbmImageFile.open, wh...

RHEL 10 : openssh (RHSA-2026:85847)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85847 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files...

Linux Distros Unpatched Vulnerability : CVE-2026-98635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the ind...

Linux Distros Unpatched Vulnerability : CVE-2026-96224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96224 Note that Nessus relies on the presence of the packag...

Linux Distros Unpatched Vulnerability : CVE-2026-96235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-96235 Note that Nessus relies on the presence of the packag...

Linux Distros Unpatched Vulnerability : CVE-2026-112391

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.getvalue can recurse without a limit while reading nested PDF objects. The parse...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31407)

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly...

RHEL 9 : python3.12-urllib3 (RHSA-2026:85929)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85929 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Linux Distros Unpatched Vulnerability : CVE-2026-98481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which...

PT-2026-118620

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A...

PT-2026-118930

Out of bounds read in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-118335

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML ERROR NO MEMORY until it is...

python3.12-urllib3 security update

1.26.19-3.2 - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282261 1.26.19-3.1 - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override HTTPS proxy TLS configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-98485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address...

Linux Distros Unpatched Vulnerability : CVE-2026-98495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ byte...

Linux Distros Unpatched Vulnerability : CVE-2026-98567

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it...