PT-2026-61667

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.221 Description An unauthenticated remote attacker can download attachments created by older versions of the software. This occurs because the attachment download route skips token authentication when the token...

Linux Distros Unpatched Vulnerability : CVE-2026-63947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that...

CVE-2026-64007

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

PT-2026-61641

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the rmnet dellink function. The function removes an endpoint from the hash table and frees it immediately using kfree. However, RCU readers on the receiv...

Linux Distros Unpatched Vulnerability : CVE-2026-64126

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: MGMT: validate Add Extended Advertising Data length MGMTOPADDEXTADVDATA is registered as a variable-length command, with MGMTADDEXTADVDATASIZE as the...

Linux Distros Unpatched Vulnerability : CVE-2026-64154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the...

Linux Distros Unpatched Vulnerability : CVE-2026-64034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: Fix TOCTOU double-fetch of hwcmsgid from DMA buffer In manahwcrxeventhandler, resp-response.hwcmsgid is read from DMA-coherent memory and...

Linux Distros Unpatched Vulnerability : CVE-2026-64024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable,...

Linux Distros Unpatched Vulnerability : CVE-2026-64028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns everywhere...

Linux Distros Unpatched Vulnerability : CVE-2026-64006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The lo...

UBUNTU-CVE-2026-64082

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

CVE-2026-64006

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

TencentOS Server 4: perl-DBI (TSSA-2026:0611)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0611 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-67300

Name of the Vulnerable Software and Affected Versions axios versions 0.31.1 through 0.32.x axios versions 1.15.2 through 1.17.x Description In Node.js deployments using the HTTP adapter, a bypass of prototype pollution hardening allows requests to be routed through an attacker-controlled proxy...

CVE-2026-64082

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since cregs is an uninitialized stack variable, a copyin failure causes...

Linux Distros Unpatched Vulnerability : CVE-2026-64082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - riscv: Fix register corruption from uninitialized cregs on error compatriscvgprset calls cregstoregs unconditionally, even when userregsetcopyin fails. Since...

Linux Distros Unpatched Vulnerability : CVE-2026-63944

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: fix UAF in hcilecreatecissync hcilecreatecissync dereferences conn-conntimeout after releasing both rcureadlock and hcidevlockhdev. The con...

PT-2026-61555

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description An arbitrary file read issue exists in the DEFINE ANALYZER mapper filter. Database users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying arbitrary file...

PT-2026-67295

Name of the Vulnerable Software and Affected Versions axios versions 0.31.0 through 0.32.x axios versions 1.15.0 through 1.17.x Description In Node.js applications using the HTTP adapter, the software fails to recognize 0.0.0.0 as a loopback address within the shouldBypassProxy function located i...

Important: perl-DBI

Issue Overview: DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation o...