PT-2026-71875

Name of the Vulnerable Software and Affected Versions AgenticSeek version fc242c7 Description An unauthenticated remote code execution issue exists that allows network-adjacent attackers to execute arbitrary commands. By submitting crafted queries to the unprotected 'POST /query' API endpoint, an...

Linux Distros Unpatched Vulnerability : CVE-2026-73071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, jsondecodeitem in src/json.c can retain a stale pointer after jsondecodestring...

CVE-2026-73147

GHSA-pc2g-2p95-4cr5: TCL command injection in reflector client...

PT-2026-71782

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...

openSUSE 16: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (openSUSE-SU-2026:21553-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21553-1 advisory. This update for GraphicsMagick fixes the following issue: - CVE-2026-56379: arbitrary MVG drawing command injection via the SVG decoder when processing...

PT-2026-71901

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description A malicious GOPROXY could forge up to two sumdb tiles, enabling a requested module to bypass the GOSUMDB check. This allows attacker-controlled module content to persist in a local Go module cache...

PT-2026-71488

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the...

RockyLinux 9 : python3.9 (RLSA-2026:54268)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54268 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

PT-2026-71628

rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC CONNECT PROG environment variable, daemon hooks, the rsync-ssl wrapper, and...

Vim < 9.2.0847 Arbitrary Command Execution (GHSA-r22p-fhw4-84p2)

The version of Vim installed on the remote host is prior to 9.2.0847. It is, therefore, affected by a vulnerability as referenced in the GHSA-r22p-fhw4-84p2 advisory. - runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with...

Adobe ColdFusion 2023.x < 2023 Update 23 / 2025.x < 2025 Update 12 Multiple Vulnerabilities (APSB26-90)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 23 or 2025.x update 12. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-90 advisory. - Improper Neutralization of Special Elements used in an OS Command 'OS Command...

Linux Distros Unpatched Vulnerability : CVE-2026-63294

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image o...

Linux Distros Unpatched Vulnerability : CVE-2026-48554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro...

Linux Distros Unpatched Vulnerability : CVE-2026-73075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popupmarkopacityzindex in src/popupwin.c can use a negative wwinrow for a...

Linux Distros Unpatched Vulnerability : CVE-2026-18370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - entr is vulnerable to Heap-based buffer overflow in runutility function. The function allocates a fixed-size heap buffer using mallocARGMAX and copies...

UBUNTU-CVE-2026-73070

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c,...

UBUNTU-CVE-2026-73147

GHSA-pc2g-2p95-4cr5: TCL command injection in reflector client...

Vim < 9.2.0839 OS Command Injection (GHSA-r5v6-q6j8-8qw2)

The version of Vim installed on the remote host is prior to 9.2.0839. It is, therefore, affected by a vulnerability as referenced in the GHSA-r5v6-q6j8-8qw2 advisory. - The runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled...

AlmaLinux 8 : vim (ALSA-2026:38510)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:38510 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim:...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...