EUVD-2026-66873

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

Installer for Rakuten Kobo Desktop Application (Windows version) may insecurely load Dynamic Link Libraries

Overview The installer for Rakuten Kobo Desktop Application Windows version contains the following vulnerability in the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Uncontrolled search path element CWE-427 - CVE-2026-68955 Yukihiro Nakamura reported this...

CVE-2026-47875 JobParameterDeserializer bypasses the trusted-type allowlist

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

EUVD-2026-66839

Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...

PT-2026-82602

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software uses a denylist to identify trusted built-in plugins, which allows unsigned plugins located in top-level plugins/ directories and unknown subdirectories to bypass signature...

SUSE SLES12: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (SUSE-SU-2026:3793-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3793-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

PT-2026-82614

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient controls during the execution of untrusted third-party plugins allow for arbitrary code execution with the privileges of the user running the software. This occurs because the...

EUVD-2026-67122

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

CVE-2026-75357

Bilibili Desktop v.1.17.9 contains a vulnerability in the bili-inject.js and bili-bridge.js components that allows a remote attacker to execute arbitrary code without requiring authentication or user interaction. The vulnerability is rated CVSS 9.8 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/...

Debian dsa-6471 : libwireshark-data - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6471 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6471-1 [email protected] https://www.debian.org/securit...

CVE-2026-75357

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

VulnCheck KEV: CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

SUSE SLES12: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (SUSE-SU-2026:3794-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3794-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

Debian dsa-6473 : libdbi-perl - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6473 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6473-1 [email protected] https://www.debian.org/securit...

MiracleLinux 9 : sqlite-3.34.1-11.el9_8 (AXSA:2026-1681:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1681:03 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

The vulnerability of the getTarSpec() function in the tools/rpmbuild.cc component of the RPM package manager allows a hacker to execute arbitrary code.

The vulnerability of the getTarSpec function in the tools/rpmbuild.cc component of the RPM package manager is related to improper code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2026-82652

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description A code injection issue exists in the ServiceNow AI platform. This flaw allows an unauthenticated user to execute arbitrary code, potentially enabling unauthorized access to or...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

CVE-2026-58474

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...

EUVD-2026-66642

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The...