249609 matches found
RHEL 9 : osbuild-composer (RHSA-2026:69293)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69293 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...
Important: postgresql security update
PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...
Important: osbuild-composer security update
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium CVE-2026-19173...
Important: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...
OPENSUSE-SU-2026:21883-1 Security update for freeipmi
This update for freeipmi fixes the following issues: - CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses bsc1278719. - CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem bsc1278722. - CVE-2026-85506: Arbitrary code execution via...
PT-2026-95974
Name of the Vulnerable Software and Affected Versions D-Link DIR-868L version 2.01b05 Description A stack-based buffer overflow exists in the Authentication Handler component within the /webfa authentication.cgi endpoint. The issue occurs when the strcpy function processes the id and password...
CVE-2026-81650: Unrestricted Upload of File with Dangerous Type
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...
PT-2026-95915
Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to correctly validate file extensions when extracting files from an uploaded archive. This occurs because a variable is reused as a...
CVE-2026-87067: Improper Control of Generation of Code
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...
PT-2026-95903
Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.7 Description A use-after-free flaw exists in the Http2ThreadMultiBuf component. This occurs when the system inspects HTTP/2 transactions using rules that apply http.response header both with and without a...
PT-2026-95909
Name of the Vulnerable Software and Affected Versions Kamailio versions prior to 6.0.8 Description A heap-based buffer overflow can be triggered remotely within the CDP Diameter Receiver component. The issue resides in the shm malloc function located in the src/modules/cdp/receiver.c file. A...
Debian dsa-6509 : gimp - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6509 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6509-1 [email protected] https://www.debian.org/securit...
SUSE CVE-2026-93337
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a val...
UBUNTU-CVE-2026-78030
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. DBD::DBM passes the dbmtype and dbmmldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename a...
CVE-2026-78030
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. DBD::DBM passes the dbmtype and dbmmldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename a...
CVE-2026-78030
Perl DBI versions prior to 1.653 are vulnerable to arbitrary module loading due to unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM . The root cause is that DBD::DBM passes these attributes to require without verifying if they point to modules. Since require treats path-shaped strings as...
EUVD-2026-83584
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. DBD::DBM passes the dbmtype and dbmmldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename a...
PT-2026-95900
Name of the Vulnerable Software and Affected Versions Comfast CF-N1-S version 2.6.0.1 Description The Web Management Interface contains a stack-based buffer overflow that can be triggered remotely. The issue exists within the get css path from uri function located in the /cgi-bin/mbox-config...
CVE-2026-78030: Use of Externally-Controlled Input to Select Classes or Code
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. DBD::DBM passes the dbmtype and dbmmldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename a...