sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

CVE-2026-82862: Untrusted Search Path

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution...

CVE-2023-20511: Release of Invalid Pointer or Reference

Release of an invalid pointer in the AMD kernel mode driver KMD could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution...

ROS-20260831-73-0004

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the com_baforms component of the Balbooa Forms extension in the Joomla content management system allows a hacker to execute arbitrary code.

The vulnerability of the combaforms component of the Balbooa Forms extension in the Joomla content management system involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of IBM Langflow OSS’s visual development software for AI agents lies in the failure to eliminate instructions in dynamically executed code, allowing attackers to execute arbitrary code.

The vulnerability of the software for visual development of IBM Langflow OSS AI agents lies in the failure to take measures to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the DIAFAN.CMS content management system lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the DIAFAN.CMS content management system lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RHEL 8 : freerdp (RHSA-2026:61250)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61250 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RHEL 9 : freerdp (RHSA-2026:61379)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61379 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RockyLinux 8 : mingw-sqlite (RLSA-2026:61242)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61242 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 Tenable has extracted the preceding description block directly fro...

Important: gstreamer1-plugins-bad-free

Issue Overview: A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated...

PT-2026-83950

Name of the Vulnerable Software and Affected Versions AMD kernel mode driver affected versions not specified Description Release of an invalid pointer in the AMD kernel mode driver KMD could allow a privileged attacker to create a double free condition, which may lead to arbitrary code execution....

CVE-2026-82867: Improper Neutralization of Input During Web Page Generation

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

PaperCut NG/MF Unsafe Reflection Vulnerability

PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained...

Amazon Linux 2023 : gstreamer1-plugin-openh264, gstreamer1-plugins-bad-free, gstreamer1-plugins-bad-free-devel (ALAS2023-2026-2119)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2119 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for...

RHEL 8 : libxml2 (RHSA-2026:61248)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61248 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code...

ALSA-2026:61248 Moderate: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 For more details about the security issues, including the impact, a CVSS score,...

Linux Distros Unpatched Vulnerability : CVE-2026-77650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency...

Adobe XD 60.0 < 61 Arbitrary code execution (APSB26-125) (macOS)

The version of Adobe XD installed on the remote macOS host is prior to 61. It is, therefore, affected by a vulnerability as referenced in the APSB26-125 advisory. - Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current...