PT-2026-120969

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube user::query matched the address against identity records without qualifying the lookup by IMAP host, so a...

PT-2026-121321

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable...

SUSE SLED15: bouncycastle / bouncycastle-pg / bouncycastle-pkix / etc (SUSE-SU-2026:4797-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4797-1 advisory. - CVE-2026-17507: negative signed leafindex values from unsigned wire encodings can cause heap exhaustion...

openSUSE 16 Security Update : gitoxide (openSUSE-SU-2026:22126-1)

"The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22126-1 advisory. Changes in gitoxide: Update to version 0.60.0: BREAKING: remove the full-screen progress mode: the --progress and --progress-keep-open flags and the...

Linux Distros Unpatched Vulnerability : CVE-2026-114721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabledactions configuration setting to be bypassed. The check compared only the action name ...

openSUSE 16 Security Update : grafana (openSUSE-SU-2026:22125-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22125-1 advisory. Changes in grafana: Update to version 12.4.10: Security: CVE-2026-17183: Fix exposing data accessible through Grafana's configured datasource...

RHEL 10 : sudo (RHSA-2026:86633)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:86633 advisory. The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-143032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-143032 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix portid extraction from SRC TAG On the packet reception pat...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142714)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142714 advisory. In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASKOFFSTACK memory corruption This patch addresses a critical memory...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-142762)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142762 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing...

CentOS Linux 6 [TuxCare] Security Update: libX11 / libX11-common / libX11-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792609205)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792609205 advisory. - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the firs...

PT-2026-135064

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2 in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string...

CentOS Linux 6 [TuxCare] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792612974)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792612974 advisory. - An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack...

Memory corruption vulnerabilities in PHP

Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve...

Oracle Linux 8 : php:7.4 (ELSA-2026-87080)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-87080 advisory. - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619 - Fix IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address...

openSUSE 16 Security Update : aliyun-cli (openSUSE-SU-2026:22140-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22140-1 advisory. This update for aliyun-cli fixes the following issue: - CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict allows an...

PT-2026-134734

Security vulnerability affects the kafka package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable...

penligent-recreation

Penligent — Recreation A high-fidelity reconstruction of Pe...

SUSE CVE-2026-98641

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

SUSE CVE-2026-112943

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...