Linux Distros Unpatched Vulnerability : CVE-2025-60476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service Do...

PT-2026-121936

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvmet req alloc p2pmem sgls function where req-p2p dev is assigned only after both data and metadata SGL Scatter Gather List allocations succeed. If data allocatio...

PT-2026-121917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the HID steam component during the teardown sequence. A narrow timing window allows callbacks to be scheduled during cleanup, resulting in a dangling pointer to the free...

PT-2026-121945

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the AMT Automatic Multicast Tunneling module. An socket buffer skb queued in a queuing discipline qdisc can outlive the tunnel it references via a raw...

Linux Distros Unpatched Vulnerability : CVE-2026-99054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues...

MiracleLinux 8 : php:8.0 (AXSA:2026-2130:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2130:01 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state...

Important: php:7.3 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

MiracleLinux 8 : librsvg2-2.42.7-6.el8_10 (AXSA:2026-2133:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2133:01 advisory. librsvg: Use-after-free when XML includes have duplicated entities CVE-2026-96889,RUSTSEC-2026-0305 Tenable has extracted the preceding description block...

AlmaLinux 9 : ALSA-2026:A014php:8.1 (ALSA-2026:A014)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:A014 advisory. php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading t...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions 5.15.222 through 5.16. It arises because ksmbdsessionsderegister fails to remove stale channels from all sessions when a connection is dropped, resulting in post-release reuse of freed ksmbdconn objects and subsequent session leaks...

Important: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: OOM bailout during request parsing leads to memory corruption and RCE CVE-2026-109618 php: fatal error handling retains stale request state leading to use-after-free CVE-2026-109619 For more...

SUSE CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

SUSE CVE-2026-98663

In the Linux kernel, the following vulnerability has been resolved: iio: imu: adis16480: fix unprotected debugfs reads The firmwarerevision and firmwaredate file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does...

SUSE CVE-2026-98666

In the Linux kernel, the following vulnerability has been resolved: iio: gyro: adis16136: fix unprotected debugfs reads The serialnumber file operations are open coded and never call debugfsfileget, which debugfscreatefileunsafe requires. debugfsremoverecursive therefore does not wait for a read ...

SUSE CVE-2026-98670

In the Linux kernel, the following vulnerability has been resolved: iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind The ZYNQ XADC alarm IRQ handler queues zynqunmaskwork via scheduledelayedwork; that work is cleared by a devm callback. Register the devm callback befo...

SUSE CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

🛡️ php2shell-enterprise-hardening CVE-2026-109618 / CVE-2026-...

K000163847: libssh vulnerability CVE-2026-59850

Security Advisory Description A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. CVE-2026-59850 Impact An attacker, i...

CVE-2026-98083

A flaw was found in the Linux kernel's Btrfs file system. An improper error-handling sequence during RAID stripe extent insertion can prematurely release transaction objects if memory allocation fails. A local user could exploit this flaw to trigger a use-after-free condition, leading to a system...

CVE-2026-98090

A flaw was found in the Linux kernel's Btrfs file system. A local user could exploit this vulnerability to cause a Denial of Service DoS by crashing the system. During device initialization, if setup fails, the error-handling path releases the new device without restoring active device pointers...