Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142714)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142714 advisory. In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory...

PT-2026-121578

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

PT-2026-120945

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142708)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142708 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR length calculation in nfsd4ffencodelayoutget The XDR buffer size calculation in...

PT-2026-120969

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube user::query matched the address against identity records without qualifying the lookup by IMAP host, so a...

openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:22126-1)

"The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22126-1 advisory. Changes in gitoxide: Update to version 0.60.0: BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142720)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142720 advisory. In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory...

RHEL 8 : sudo (RHSA-2026:87026)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:87026 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

openSUSE 16 Security Update : aliyun-cli (openSUSE-SU-2026:22140-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22140-1 advisory. This update for aliyun-cli fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an...

RHEL 10 : sudo (RHSA-2026:86633)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86633 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory. Changes in grafana: Update to version 12.4.10: Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource...

Memory corruption vulnerabilities in PHP

Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve...

Oracle Linux 8 : php:7.4 (ELSA-2026-87080)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87080 advisory. - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619 - Fix IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792612974)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792612974 advisory. - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack...

penligent-recreation

Penligent — Recreation A high-fidelity reconstruction of Pe...

SUSE CVE-2026-98641

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

SUSE CVE-2026-112943

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd53cc46174e799bbe5340512eb53aa19d00168034876b49d53671f90b15b83 Package dictanovaasr version 0.1.0 was examined and no evidence of exfiltration, install-time or import-time code execution from external sources,...

MAL-2026-18139 Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd53cc46174e799bbe5340512eb53aa19d00168034876b49d53671f90b15b83 Package dictanovaasr version 0.1.0 was examined and no evidence of exfiltration, install-time or import-time code execution from external sources,...

MAL-2026-18142 Malicious code in orchestril (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7191855f520c024b0d8a705ec8f900030ecadccb35f1831e1145804b4a36b62d The package orchestril 0.1.0 was examined and no indicators of installer-side harm were observed. There is no evidence of install-time or import-time...