MiracleLinux 9 : postgresql-13.10-1.el9 (AXSA:2023-5280:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5280:02 advisory. postgresql: Extension scripts replace objects not belonging to the extension. CVE-2022-2625 postgresql: Client memory disclosure when connecting wit...

curl: Cookie Replacement Use-After-Free Vulnerability

Summary: The cookie replacement logic in lib/cookie.c contains a use-after-free vulnerability in the replaceexisting function. The function modifies a linked list while iterating over it, creating potential for memory corruption in concurrent or complex cookie operations. Vulnerable Code Location...

Why Replace Kenna with Hive Pro? A Full Comparison

If your security team is drowning in alerts and spending more time triaging than remediating, you know the old approach to vulnerability management is broken. Chasing endless CVEs and trying to stitch together data from a dozen different tools leads to burnout and leaves critical gaps in your...

CVE-2025-61973

A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL file during the installation process, which may result in unintended elevation of privileges...

CVE-2025-61973

A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL file during the installation process, which may result in unintended elevation of privileges...

EUVD-2026-2749

A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A low-privilege user can replace a DLL file during the installation process, which may result in unintended elevation of privileges...

CVE-2025-61973

CVE-2025-61973 is a local privilege escalation in the Epic Games Store installation via Microsoft Store. Cisco Talos details a DLL hijacking path: a writable %TEMP% directory allows replacing dxupdate.dll, which DXSETUP.exe later loads with SYSTEM privileges, yielding elevation. Affected versions...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003405)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003405 advisory. The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002658)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002658 advisory. In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002777)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002777 advisory. In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002250)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002250 advisory. The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a...

CVE-2025-71140

CVE-2025-71140 : In the Linux kernel, the media: mediatek: vcodec context lists were previously protected by a mutex, but the IPI handler for MT8173 runs in hard IRQ context, which could trigger a NULL pointer dereference due to unexpected changes in the context lists. The fix switches the protec...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000948)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000948 advisory. The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a...

CVE-2022-50931

TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers can replace system executables like ts3clientwin32.exe with custom files to potentially gain SYSTEM or Administrator-level access...

CVE-2022-50931 TeamSpeak 3.5.6 - Insecure File Permissions

TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers can replace system executables like ts3clientwin32.exe with custom files to potentially gain SYSTEM or Administrator-level access...

kernel: sctp: avoid NULL dereference when chunk data buffer is missing

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk-skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk-skb can only be NULL if chunk-headskb is not. Check for fraglist instead...

CVE-2026-22712

Improper Encoding or Escaping of Output due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39...

CVE-2021-31876

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attackers to trigger a loss of funds, or a denial of service attack against downstream projects such as Lightning network nodes. An unconfirmed child transaction wi...

CVE-2021-22038

On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed the originally called uninstaller exits, so it does not block the installation directory. This temporary location is not randomized and does not restrict access to Administrators only so a...

CVE-2022-23334

The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE...