CVE-2026-71612

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmxprocess function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

Vulnerabilities in Ivanti Neurons for ITSM

Ivanti has addressed several vulnerabilities in Ivanti Neurons for ITSM. A malicious individual could exploit these vulnerabilities to perform unauthorized actions, including executing arbitrary code on the server. Ivanti released an update in version 2026.2 to fix these vulnerabilities. See the...

CVE-2026-85102

Check Point Security Gateway and Spark Firewall are vulnerable to a critical issue (CVSS 9.8 ) caused by improper certificate trust validation during VPN negotiation . An unauthenticated remote attacker can bypass authentication checks to execute arbitrary code on the Gateway. The flaw affects Si...

CVE-2026-85102 Improper Certificate Validation in Quantum Security Gateway

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway...

DEBIAN-CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

expat security update

An update is available for expat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: libexpa...

CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

CVE-2026-65181

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code. Users are recommended to upgrade to version 4.5.2, which fixes this issue...

Important: Red Hat Security Advisory: perl-DBI security update

An update for perl-DBI is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546...

CVE-2026-79696

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

Security update for libssh2_org

This update for libssh2org fixes the following issues: CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. CVE-2026-7598: integer overflow in function userauthpassword of file src/userauth.c bsc1263890. CVE-2026-58050: attacker controlled...

EUVD-2026-74768

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

CVE-2026-21101

Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitrary code with root privilege...

CVE-2026-12855

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects...

MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

CVE-2026-12855

CVE-2026-12855 is an unvalidated memory boundary flaw in H19WMIHandlerSmm , an SMM (System Management Mode) handler component in UEFI firmware. The vulnerable code was developed specifically for HP projects and is associated with Insyde firmware (per the Insyde security advisory reference). An at...

AZL-100014 CVE-2026-87612 affecting package nodejs 24.21.0-1

Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...