ALSA-2026:55442 Important: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

CVE-2026-38165

CVE-2026-38165 is a Critical (CVSS 9.8) Server-Side Template Injection (SSTI) vulnerability in OpenSAGRES XDocReport versions 0.9.2 through 2.2.0 , specifically in the fr.opensagres.xdocreport.template.velocity component. When processing DOCX templates with the Apache Velocity engine, a crafted t...

PT-2026-76812

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

Important: qemu

Issue Overview: In QEMU's VNC server implementation ui/vnc.c, the setpixelformat function does not properly validate the redmax, greenmax, and bluemax fields from a client's SetPixelFormat message. These fields are received as 16-bit values but are stored internally as uint8t. A malicious VNC...

PT-2026-76876

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.7.0 through 11.7.6 Mattermost versions 10.11.0 through 10.11.21 Mattermost versions 11.8.0 through 11.8.3 Description Insufficient server-side validation of BoardMember.Scheme fields during insert and archive-import...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099525)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099525 advisory. Externally-controlled format string in PostgreSQL timeofday function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions...

RockyLinux 10 : libXfont2 (RLSA-2026:55448)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55448 advisory. libxfont2: Font Server Client encoding Out-Of-Bounds Read/Write CVE-2026-59679 libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in...

Tanium Server 7.7.3.x < 7.7.3.8298 / 7.8.2.x < 7.8.2.1198 / 7.8.4.x < 7.8.4.1327 UI Misrepresentation (TAN-2026-017)

The version of Tanium Server installed on the remote host is 7.7.3.x prior to 7.7.3.8298, 7.8.2.x prior to 7.8.2.1198, or 7.8.4.x prior to 7.8.4.1327. It is, therefore, affected by a vulnerability: - A UI misrepresentation of critical information vulnerability could allow an authenticated Tanium...

FreeBSD : gitea -- Multiple vulnerabilities (2f3568eb-999e-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2f3568eb-999e-11f1-a655-3497f65b111b advisory. Gitea reports This release contains fixes for 45 security issues, including privilege...

PT-2026-76691

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible...

PT-2026-73437

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume grpc remote.go fetches a caller-supplied remote endpoint through weed/remote storage/s3/s3 storage client.go and writes the response into a needle. The RPC performs no authentication a...

The vulnerability in the `fs/smb/server/transport_tcp.c` component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability in the fs/smb/server/transporttcp.c component of the Linux operating system is related to improper memory release before deleting the last reference. Exploiting this vulnerability can allow an attacker to cause a service failure...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099465)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099465 advisory. Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099467 advisory. Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser ...

Important: wget

Issue Overview: GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document containing a whitespace-only URL...

PT-2026-76866

Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0 Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/persona id' endpoints expose the OAuth Authorization header...

PT-2026-76819

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing...

The vulnerability of the PolicyReference programming interface in the Java framework of Apache Neethi allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the PolicyReference programming interface in the Apache Neethi Java framework is related to insufficient validation of requests on the server side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-19964

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jijmcp/pythonrepr.py of the component jmcheck. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-19964 Jij-Inc Jij-MCP-Server jm_check python_repr.py PythonREPL.run code injection

A vulnerability was found in Jij-Inc Jij-MCP-Server 0.1.0. This affects the function PythonREPL.run of the file jijmcp/pythonrepr.py of the component jmcheck. The manipulation of the argument code results in code injection. It is possible to launch the attack remotely. The exploit has been made...