The vulnerability of the com_baforms component of the Balbooa Forms extension in the Joomla content management system allows a hacker to execute arbitrary code.

The vulnerability of the combaforms component of the Balbooa Forms extension in the Joomla content management system involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

RHEL 8 : libxml2 (RHSA-2026:61248)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61248 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-2119)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2119 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for...

Adobe XD 60.0 < 61 Arbitrary code execution (APSB26-125) (macOS)

The version of Adobe XD installed on the remote macOS host is prior to 61. It is, therefore, affected by a vulnerability as referenced in the APSB26-125 advisory. - Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current...

Linux Distros Unpatched Vulnerability : CVE-2026-39275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and...

Amazon Linux 2 : postgresql, --advisory ALAS2-2026-3900 (ALAS-2026-3900)

The version of postgresql installed on the remote host is prior to 9.2.24-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3900 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to caus...

Linux Distros Unpatched Vulnerability : CVE-2026-77650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency...

OPENSUSE-SU-2026:21701-1 Security update for postgresql16

This update for postgresql16 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21702-1 Security update for postgresql17

This update for postgresql17 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21700-1 Security update for postgresql15

This update for postgresql15 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21699-1 Security update for postgresql14

This update for postgresql14 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

OPENSUSE-SU-2026:21703-1 Security update for postgresql18

This update for postgresql18 fixes the following issues: - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership bsc1275044. - CVE-2026-6470: failure to check type USAGE...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642 Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag FORBIDTAGS: 'script' in apps/readest-app/src/services/transformers/sanitizer.ts. DOMPurify does not parse the content...

CVE-2026-82642

Readest is an open-source e-book reader built on Tauri . In versions prior to 0.11.16 , the EPUB HTML sanitizer (DOMPurify) in apps/readest-app/src/services/transformers/sanitizer.ts forbade only the [removed] tag. Because DOMPurify treats the srcdoc attribute on elements as an opaque string, a ...

CVE-2026-81766

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

EUVD-2026-68160

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

OESA-2026-3573 gimp security update

The GIMP is an image composition and editing program, which can be used for creating logos and other graphics for Web pages. The GIMP offers many tools and filters, and provides a large image manipulation toolbox, including channel operations and layers, effects, subpixel imaging and antialiasing...