Linux Distros Unpatched Vulnerability : CVE-2026-80230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - curl - None CVE-2026-80230 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

Linux Distros Unpatched Vulnerability : CVE-2026-84359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data vi...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105438)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105438 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fhid: fix refcount leak on error path When failing to allocate reportdesc, opts-refc...

Linux Distros Unpatched Vulnerability : CVE-2026-84310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/doccommon.py getoutline to consume long...

Linux Distros Unpatched Vulnerability : CVE-2026-84640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.1...

PT-2026-84904

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX AVC444 BITMAP STREAM with specific frame geometry to trigger an out-of-bounds memory read past the...

RockyLinux 10 : nodejs22 (RLSA-2026:61376)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61376 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

Linux Distros Unpatched Vulnerability : CVE-2026-84333

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a craft...

PT-2026-85007

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/path guard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105539 advisory. A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter...

Linux Distros Unpatched Vulnerability : CVE-2026-73270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected...

CVE-2026-59346

CVE-2026-59346 is an integer-overflow vulnerability in the VMXNET3 virtual network adapter of VMware Workstation and VMware Fusion (versions 25H2 and 26H1). Per advisory VMSA-2026-0007, a malicious actor with local administrative privileges on a guest VM can exploit this flaw to execute code on t...

PT-2026-85054

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-67397

CVE-2026-67397 affects Plesk for Linux and could allow a Plesk user to execute code with root privileges , representing a privilege escalation vulnerability. The initial CVE entry is still in reserved/placeholder status, but PT-2026-85033 provides concrete details: administrators should update to...

Tenda HG21 Hardcoded Root Credentials

Firmware analysis of the Tenda HG21 XPON fiber modem revealed a hardcoded administrative account baked into the shipped firmware image. The account is granted full root privileges UID 0 and its credentials are static across devices, meaning any attacker who can reach an exposed management service...

PT-2026-84992

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

PT-2026-85002

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

PT-2026-85004

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

PT-2026-84923

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass...

PT-2026-84953

In the Linux kernel, the following vulnerability has been resolved: selinux: reject a permission value exceeding the class permission count perm read bounds a permission value by SEL VEC MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image...