Linux Distros Unpatched Vulnerability : CVE-2026-98641

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46294)

"In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson using Claude found a buffer overflow in dm-ioctl in the function retrievestatus: 1. The code in retrievestatus checks that the output string fits into the output buffer...

Fedora 43 : baresip / libre (2026-ff2a4f31ce)

The remote Fedora 43 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-ff2a4f31ce advisory. Baresip v4.12.0 2026-09-30 - Feature: Send Custom X-Headers on Outbound Calls - audio: thread-safe usage of psize and ptime in txthread - jbuf: safer jbufset...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792021687)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792021687 advisory. - GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been...

PT-2026-118404

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description On Windows, the software fails to escape the % character when passing arguments to cmd.exe. This occurs because .bat or .cmd files cannot be called directly via child process.spawn and must be...

PT-2026-118496

Name of the Vulnerable Software and Affected Versions uploadfs versions prior to 1.28.0 Description The local storage backend of the uploadfs library fails to properly validate or sanitize user-supplied paths. The prefixPath function only removes double slashes and does not normalize paths or...

PT-2026-118614

Name of the Vulnerable Software and Affected Versions virtualenv versions 21.14.8 through 21.14.9 Description The app-data seeder may leave an environment linked to temporary package files that are deleted upon completion of the creation process. This state can be triggered via environment-variab...

Totolink X2000R boa formParentControl url stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to...

Totolink X2000R boa formMapDelDevice hostname stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to...

Totolink X2000R boa formWsc targetAPSsid OS command injection vulnerability

Summary A OS command injection vulnerability exists in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-118586

Name of the Vulnerable Software and Affected Versions @apostrophecms/ai-helper versions 1.0.0-beta.10 through 1.0.0-beta.12 Description An authenticated editor can trigger a Server-Side Request Forgery SSRF by exploiting the way the server resolves image URLs. When a global base URL is not...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

Security update for gitoxide (moderate)

openSUSE security update: security update for gitoxide ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22126-1 Rating: moderate References: bsc1281749 Cross-References: CVE-2026-91986 CVSS scores: CVE-2026-91986 SUSE : 5.4...

Security update for grafana (important)

openSUSE security update: security update for grafana ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22125-1 Rating: important References: bsc1263330 bsc1265525 bsc1265763 bsc1268868 bsc1269841 bsc1271330 bsc1272008 bsc1272328 bsc1272427 bsc1274217...

Totolink X2000R boa formUpload() heap-based buffer overflow vulnerability

Summary A heap-based buffer overflow vulnerability exists in the boa formUpload functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R boa formIpv6Setup Static Network Configuration Stack-Based Buffer Overflow Vulnerabilities

Summary Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTT...

Totolink X2000R boa formWsc peerRptPin OS command injection vulnerability

Summary A OS command injection vulnerability exists in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Testing TLS 1.3 PQC on Constrained Devices and Microcontrollers

The UK, EU and US governments have set timelines for post-quantum cryptography migration of critical systems, with deadlines ranging from 2028 to 2035. This paper focuses on IoT-class devices and microcontrollers and the viability of using PQC to connect these devices in secure TLS 1.3 connection...

Linux Distros Unpatched Vulnerability : CVE-2026-108518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI versions before 1.656 for Perl crash via type confusion in dbiprofile when a database handle is destroyed under a Profile Path with an attr element. An attr...

Use of Uninitialized Variable

Overview Affected versions of this package are vulnerable to Use of Uninitialized Variable via fontrenderimpl in src/imagingft.c, where a FTGlyph object can be freed via FTDoneGlyph during the rendering loop when a stroker is active, and then freed a second time in the glypherror cleanup path due...