The vulnerability of the DIAFAN.CMS content management system lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RockyLinux 8 : mingw-sqlite (RLSA-2026:61242)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61242 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 Tenable has extracted the preceding description block directly fro...

RHEL 8 : freerdp (RHSA-2026:61250)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61250 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RHEL 10 : sqlite (RHSA-2026:61697)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61697 advisory. SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a...

RHEL 9 : freerdp (RHSA-2026:61379)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61379 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Debian dla-4764 : libdbi-perl - security update

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4764 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4764-1 [email protected]...

Important: gstreamer1-plugins-bad-free

Issue Overview: A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated...

The vulnerability of IBM Langflow OSS’s visual development software for AI agents lies in the failure to eliminate instructions in dynamically executed code, allowing attackers to execute arbitrary code.

The vulnerability of the software for visual development of IBM Langflow OSS AI agents lies in the failure to take measures to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Important: postgresql17

Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...

Adobe XD 60.0 < 61 Arbitrary code execution (APSB26-125) (macOS)

The version of Adobe XD installed on the remote macOS host is prior to 61. It is, therefore, affected by a vulnerability as referenced in the APSB26-125 advisory. - Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current...

RHEL 8 : libxml2 (RHSA-2026:61248)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61248 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-2119)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2119 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for...

Linux Distros Unpatched Vulnerability : CVE-2026-39275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and...

Amazon Linux 2 : postgresql, --advisory ALAS2-2026-3900 (ALAS-2026-3900)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3900 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to caus...

Linux Distros Unpatched Vulnerability : CVE-2026-77650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency...

PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained...

OPENSUSE-SU-2026:21701-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21702-1 Security update for postgresql17

This update for postgresql17 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21700-1 Security update for postgresql15

This update for postgresql15 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21699-1 Security update for postgresql14

This update for postgresql14 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...