sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

CVE-2026-76843

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

CVE-2026-59567

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...

CVE-2026-59568

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...

CVE-2026-59568

CVE-2026-59568 covers multiple vulnerabilities in Zscaler Client Connector (ZCC) that allow an unauthenticated, unprivileged remote attacker to achieve remote code execution in the ZCC context. The CNA-assigned CVSS 3.1 score is 9.1 (CRITICAL) , with a network attack vector, low complexity, no pr...

CVE-2026-59568 Remote Code Execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

CVE-2026-59568 Remote Code Execution

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...

Important: Red Hat Security Advisory: sqlite security update

An update for sqlite is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

EUVD-2026-64883

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...

CVE-2026-59567

Zscaler Client Connector is affected by multiple local privilege escalation vulnerabilities that allow an unprivileged user to execute arbitrary code in a privileged context . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, no user interacti...

CVE-2026-59567 Local privilege escalation

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed...

CVE-2026-76843

CVE-2026-76843 affects the official Flair wheels for versions 0.15.0 and 0.15.1 . The file flair/models/clustering.py remains present in the distributed package despite being removed from the documented API. Its ClusteringModel.load static method deserializes via pickle.loads(joblib.load(str(mode...

CVE-2026-76843 Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

CVE-2026-76843

The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...

CVE-2026-74631

A flaw was found in the Linux kernel's smcrxsplice function within the net: smc component. This vulnerability arises from an imbalance in the lifetime management of splice entries, where page references are not properly handled before being passed to splicetopipe. This can lead to a reference cou...

Important: Red Hat Security Advisory: sqlite security update

An update for sqlite is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syst...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...