PT-2026-71901

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A malicious GOPROXY could forge up to two sumdb tiles, enabling a requested module to bypass the GOSUMDB check. This allows attacker-controlled module content to persist in a local Go module cache...

PT-2026-71488

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the...

PT-2026-71782

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

RockyLinux 9 : python3.9 (RLSA-2026:54268)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54268 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...

PT-2026-71443

Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolicy evaluates raw command strings with quotes preserved while the executor tokenizes commands by stripping quotes before execution. Attackers can craft quoted commands that evade blocklist checks and...

PT-2026-71734

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...

PT-2026-71881

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

ROS-20260813-73-0003

The vulnerability in podman is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-18408

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the...

dracut security update

049-246.git20260728.0.1 - Refactor getucodefile Orabug: 36989953 - Revert the fixes for bugs 33676753 and 33888951 due to regressions Orabug: 35656614 - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch Orabug: 35268918 - Enable the code to create ifcfg file Orabug:...

CVE-2026-73075

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popupmarkopacityzindex in src/popupwin.c can use a negative wwinrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for wpopuptopoff and causing an...

UBUNTU-CVE-2026-68435

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexecload2 path filemode == 0 passes the user-space segment buffer straight to strncmp...

UBUNTU-CVE-2026-63294

A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can...

PT-2026-71472

Heap buffer overflow in PostgreSQL pg stat statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

openSUSE 16 Security Update : kak-lsp (openSUSE-SU-2026:21560-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21560-1 advisory. Changes in kak-lsp: - Update to version 21.0.2: Fix a regression that broke compatibility with Kakoune versions older than 2026.05.21 Add a...

Vim < 9.2.0840 Arbitrary Code Execution (GHSA-rcr7-f3wr-22r2)

The version of Vim installed on the remote host is prior to 9.2.0840. It is, therefore, affected by a vulnerability as referenced in the GHSA-rcr7-f3wr-22r2 advisory. - runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and...

PT-2026-71900

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A malicious GOSUMDB can serve arbitrary module content that is not present in the transparency log. This allows a coordinating GOPROXY and GOSUMDB to deliver malicious module content to a client,...

UBUNTU-CVE-2026-48554

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the comdata parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

UBUNTU-CVE-2026-73077

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...