CVE-2026-57223

A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. On Windows, the service installation logic can pass an unquoted service ImagePath. This allows a local low-privileged attacker to execute arbitrary code...

CVE-2026-67549

A flaw was found in OpenImageIO. A remote attacker could exploit this vulnerability by tricking a user into processing a specially crafted 1-bit CMYK TIFF image. The tiffinput::bitconvert function incorrectly writes 8-bit output into a smaller buffer allocated for 1-bit data, causing a heap...

CVE-2026-63422

A flaw was found in OpenImageIO. When processing specially crafted tiled OpenEXR images, where the image width is not a multiple of its tile width, a heap out-of-bounds write can occur. This vulnerability arises from incorrect calculation of scanline stride during tile reading, leading to memory...

CVE-2026-91813

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...

CVE-2026-91812

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...

CVE-2026-91815

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution...

CVE-2026-91801

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-91795

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution...

CVE-2026-91799

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution...

CVE-2026-50228

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

CVE-2026-96269

A flaw was found in GNU Emacs. A remote attacker could achieve arbitrary code execution by tricking a user into opening a specially crafted file. This vulnerability arises because an untrusted value of read-symbol-shorthands affects the intern and unintern functions, allowing for code execution...

CVE-2026-88807

A flaw was found in libXrender. Malicious X servers can exploit a heap overflow vulnerability in the RenderQueryPictFormats function. This allows them to inject arbitrary code into connected X clients, potentially leading to unauthorized control over the client's system. Mitigation Mitigation for...

CVE-2026-88806

A flaw was found in libX11. A heap-based buffer overflow vulnerability exists during the handling of XkbGetMap replies. A remote attacker, by operating a malicious X server, could exploit this flaw to potentially execute arbitrary code or cause a denial of service on the client system. User...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...