openSUSE 16: gimp / gimp-devel / gimp-extension-goat-excercises / gimp-lang / etc (openSUSE-SU-2026:21869-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21869-1 advisory. Changes in gimp: - CVE-2026-78465: 32-bit integer overflow in PCX image memory calculations can cause undersized heap allocations bsc1277378 -...

Linux Distros Unpatched Vulnerability : CVE-2026-92925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate...

PT-2026-95326

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description An improper restriction of excessive...

Amazon Linux 2023 : valkey, valkey-devel (ALAS2023-2026-3091)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3091 advisory. A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys...

RHEL 9 : gstreamer1-plugins-good (RHSA-2026:68642)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68642 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

Linux Distros Unpatched Vulnerability : CVE-2026-93395

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. T...

Oracle Linux 8 : libevent (ELSA-2026-67908)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-67908 advisory. - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Fix CVE-2026-63387: out-of-bounds write in evdns dnsnametolabels - Fix...

AlmaLinux 8 : kernel (ALSA-2026:68531)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:68531 advisory. kernel: ipvlan: Make the addrslock be per port CVE-2026-23103 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel:...

EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-3782)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : fs/smb/client: fix out-of-bounds read in cifssanitizeprepathCVE-2026-43112 lib/crypto: chacha: Zeroize permutedstate before it leaves...

Linux Distros Unpatched Vulnerability : CVE-2026-90350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mt76: reject out-of-range link ids in mt76viflink mt76viflink indexes mvif-link without validating linkid, but callers pass mvif-deflinkid / msta-deflinki...

EulerOS Virtualization 2.11.0 : python-lxml (EulerOS-SA-2026-3549)

According to the versions of the python-lxml packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the bsonnewfrombuffer function. An attacker can cause a crash by supplying crafted BSON data with a zero-length prefix, leading to a heap out-of-bounds read when the function fails to validate th...

CVE-2026-73638

Imager versions from 0.4502 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiffloadifd. tiffloadifd validates an IFD entry's data by checking that entry-offset + entry-size stays within the EXIF block, and never checks the start offset itself. Where that sum is n...

CVE-2026-54648

CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CCPERMREAD access and do not require CCPERMDELETE for the purge, noorderpurge, or deleteguests commands. An authenticated administrator with read-only customer...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-54520

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-54343

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...