CVE-2026-73725: Improper Privilege Management

A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges, leading to a complete compromise of the affected host...

CVE-2026-84202: Deserialization of Untrusted Data

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-19590: Uncontrolled Search Path Element

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

CVE-2026-58569: Inclusion of Functionality from Untrusted Control Sphere

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges...

ALSA-2026:62142 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or denial of service via crafted...

MiracleLinux 8 : mingw-sqlite-3.26.0.0-3.el8_10 (AXSA:2026-1713:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1713:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 Tenable has extracted the preceding description block directly...

PT-2026-84255

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An authenticated user with limited privileges can exploit an Inclusion of Functionality from Untrusted Control Sphere to execute arbitrary code with root privileges. Recommendations A...

CVE-2026-12663: Missing Authentication for Critical Function

A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice ...

The vulnerability of the `update_master_files_in_worker()` function on the platform for security monitoring and threat detection by Wazuh allows a malicious user to elevate their privileges to root level and execute arbitrary code.

The vulnerability of the updatemasterfilesinworker function on the platform for security monitoring and threat detection by Wazuh is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to root an...

openSUSE 16: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (openSUSE-SU-2026:21701-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21701-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

ASB-A-501155244

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

RHEL 8 : wget (RHSA-2026:62144)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62144 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Memory...

PT-2026-84225

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description An authenticated user with limited privileges can exploit a code injection flaw to execute arbitrary code with root privileges. Code injection is a type of attack where an attacker...

PT-2026-84357

Name of the Vulnerable Software and Affected Versions OpenAI Codex Desktop for Windows and macOS affected versions not specified Description The application automatically inspects Git metadata and working-tree status upon opening a workspace. If a workspace contains a repository with a malicious...

PT-2026-84493

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A signature verification bypass exists in the command line interface. This issue allows an authenticated actor with administrative privileges to execute arbitrary code on the underlying...

CVE-2026-45221: Uncontrolled Search Path Element

Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path absent from default installations. On Windows, the missing...

PT-2026-84403

Name of the Vulnerable Software and Affected Versions Konga versions prior to 2.1.0 Description A privilege escalation issue allows low-privileged local attackers to execute arbitrary code. This is achieved by placing attacker-controlled OpenSSL configuration or library files in a hardcoded...

CVE-2026-19766: Improper Authentication

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete...

CVE-2026-73776: Improper Verification of Cryptographic Signature

A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with administrative privileges to execute arbitrary code on the underlying operating system, when certain pre-conditions outside of th...

openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21703-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...