Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002930)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002930 advisory. The vmwgbsurfacedefineioctl function accessible via DRMIOCTLVMWGBSURFACECREATE in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.11.4 defines a...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002969)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002969 advisory. The vmwgbsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003343)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003343 advisory. The vmwsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels dat...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002764)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002764 advisory. The vmwgbsurfacedefineioctl function accessible via DRMIOCTLVMWGBSURFACECREATE in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.11.4 defines a...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003331)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003331 advisory. The vmwsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels dat...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003191)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003191 advisory. The vmwsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.6 does not validate addition of certain levels data,...

CVE-2026-22851

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl-primary SDLSurface is accessed after it has been...

UBUNTU-CVE-2026-22851

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl-primary SDLSurface is accessed after it has been...

CVE-2026-22851

CVE-2026-22851 concerns FreeRDP prior to 3.20.1, where a race between the RDPGFX dynamic channel thread and the SDL render thread can cause a heap use-after-free. Specifically, an escaped pointer to sdl->primary (SDL_Surface) may be accessed after the surface has been freed during RDPGFX Reset...

CVE-2026-22851 FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl-primary SDLSurface is accessed after it has been...

EUVD-2026-2677

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl-primary SDLSurface is accessed after it has been...

CVE-2026-22851 FreeRDP RDPGFX ResetGraphics race leads to use-after-free in SDL client (sdl->primary)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl-primary SDLSurface is accessed after it has been...

CVE-2026-22851

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race condition between the RDPGFX dynamic virtual channel thread and the SDL render thread leads to a heap use-after-free. Specifically, an escaped pointer to sdl-primary SDLSurface is accessed after it has been...

A 0-click exploit chain for the Pixel 9 Part 3: Where do we go from here?

Posted by Natalie Silvanovich While our previous two blog posts provided technical recommendations for increasing the effort required by attackers to develop 0-click exploit chains, our experience finding, reporting and exploiting these vulnerabilities highlighted some broader issues in the Andro...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001575)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001575 advisory. The vmwgbsurfacedefineioctl function in drivers/gpu/drm/vmwgfx/vmwgfxsurface.c in the Linux kernel through 4.10.7 does not validate certain levels data, which allows...

The 5 Stages of Cyber Threat Exposure Management

Think of your security posture like a fortress. Traditional vulnerability management gives you a long list of every potential weakness—a loose stone here, a weak gate there. A cyber threat exposure management CTEM program acts as your chief strategist, analyzing intelligence to show you exactly...

What Is a Threat Exposure Management Platform? A Guide

For years, vulnerability management has been like a doctor treating symptoms without a diagnosis. You get a report full of issues—a high temperature here, a cough there—and you try to treat the most severe ones first. But you lack the context to understand the root cause. Are these symptoms...

When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent

Web agents, powered by large language models LLMs, are increasingly deployed to automate complex web interactions. The rise of open-source frameworks e.g., Browser Use, Skyvern-AI has accelerated adoption, but also broadened the attack surface. While prior research has focused on model threats su...

The ROI Problem in Attack Surface Management

Attack Surface Management ASM tools promise reduced risk. What they usually deliver is more information. Security teams deploy ASM, asset inventories grow, alerts start flowing, and dashboards fill up. There is visible activity and measurable output. But when leadership asks a simple question, "I...

CVE-2025-68700

RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions prior to 0.23.0, a low-privileged authenticated user normal login account can execute arbitrary system commands on the server host process via the frontend Canvas CodeExec component, completely bypassing sandbox...