CVE-2026-81701: Improper Verification of Cryptographic Signature

opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...

CVE-2026-81719: Improper Control of Generation of Code

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

PT-2026-82550

Name of the Vulnerable Software and Affected Versions Bilibili Desktop version 1.17.9 Description A remote attacker can execute arbitrary code through the bili-inject.js and bili-bridge.js components. Recommendations At the moment, there is no information about a newer version that contains a fix...

Debian dsa-6471 : libwireshark-data - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6471 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6471-1 [email protected] https://www.debian.org/securit...

CVE-2026-75357

An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...

MiracleLinux 9 : sqlite-3.34.1-11.el9_8 (AXSA:2026-1681:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1681:03 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash vi...

CVE-2026-75357

Bilibili Desktop v.1.17.9 is affected by a vulnerability that allows a remote attacker to achieve arbitrary code execution . The root cause involves the bili-inject.js and bili-bridge.js components. The issue is categorized as an Improper Control of Generation of Code . No specific remediation st...

SUSE SLES12: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (SUSE-SU-2026:3794-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3794-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

Debian dsa-6473 : libdbi-perl - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6473 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6473-1 [email protected] https://www.debian.org/securit...

SUSE SLES12: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (SUSE-SU-2026:3793-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3793-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

SQLite Driver Code Execution

The vulnerability of the SQLite driver software used by Adminer for database management involves improper code generation practices. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Tenda CH22 Router Code Execution

The vulnerability of the formeditFileName function in the Tenda CH22 router’s software lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

VulnCheck KEV: CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

PT-2026-82614

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient controls during the execution of untrusted third-party plugins allow for arbitrary code execution with the privileges of the user running the software. This occurs because the...

CVE-2026-10036: Deserialization of Untrusted Data

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recoverifpossible. Attackers can...

PT-2026-82650

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover if possible. Attackers can...

Tenda CH22 Router Command Execution

The vulnerability of the formexeCommand function in the Tenda CH22 router’s microprogramming system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GitPython Submodule Config Code Execution

The vulnerability of the Submodule.config parser function in the Python library for interacting with Git repositories in GitPython is related to incorrect external management of file names or paths. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

RPM getTarSpec Code Execution

The vulnerability of the getTarSpec function in the tools/rpmbuild.cc component of the RPM package manager is related to improper code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...