CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

ALSA-2026:69607 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...

Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

ROS-20260921-73-0086

The vulnerability involves loading unreliable external data alongside reliable data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2026-94383: Unrestricted Upload of File with Dangerous Type

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

ALSA-2026:69095 Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...

PT-2026-96248

Name of the Vulnerable Software and Affected Versions Joplin Desktop for Windows versions prior to 3.7.2 Description Joplin Desktop for Windows fails to include the publisherName in the packages/app-desktop/package.json file. This omission causes the NsisUpdater.verifySignature function to skip t...

PT-2026-96096

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

PT-2026-96304

Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...

PT-2026-96642

Name of the Vulnerable Software and Affected Versions Ghostscript affected versions not specified Description Ghostscript incorrectly handles JPEG 2000 image components that have mismatched subsampling factors. An attacker could cause the application to crash or execute arbitrary code by inducing...

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

CVE-2026-88404

A remote code execution RCE vulnerability in the UniscriptExecutionService.execute function /services/script-execution.service.ts of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload...

RHEL 8 : gstreamer1-plugins-base (RHSA-2026:69531)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:69531 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium CVE-2026-19173...

SUSE SLES15: postgresql17 / postgresql17-contrib / postgresql17-devel / etc (SUSE-SU-2026:4013-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4013-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

ROS-20260921-73-0016

The vulnerability of the printing subsystem in Samba networking-enabled programs is related to the lack of measures taken to neutralize special elements during the processing of the %J parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4083-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4083-1 advisory. - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflo...

OPENSUSE-SU-2026:21883-1 Security update for freeipmi

This update for freeipmi fixes the following issues: - CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses bsc1278719. - CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem bsc1278722. - CVE-2026-85506: Arbitrary code execution via...