PT-2026-84357

Name of the Vulnerable Software and Affected Versions OpenAI Codex Desktop for Windows and macOS affected versions not specified Description The application automatically inspects Git metadata and working-tree status upon opening a workspace. If a workspace contains a repository with a malicious...

CVE-2026-19590: Uncontrolled Search Path Element

OpenAI Codex Desktop for Windows and macOS could execute attacker-controlled Git hooks because automated Git operations trusted the repository's local core.hooksPath setting. If a user opens an attacker-prepared repository whose preserved .git/config points core.hooksPath to an attacker-controlle...

ASB-A-501155244

In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ALSA-2026:62142 Moderate: wget security, bug fix, and enhancement update

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or denial of service via crafted...

CVE-2026-84268: Heap-based Buffer Overflow

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

CVE-2026-84268: Heap-based Buffer Overflow

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

CVE-2026-84268: Heap-based Buffer Overflow

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buffer size, causing...

PT-2026-84403

Name of the Vulnerable Software and Affected Versions Konga versions prior to 2.1.0 Description A privilege escalation issue allows low-privileged local attackers to execute arbitrary code. This is achieved by placing attacker-controlled OpenSSL configuration or library files in a hardcoded...

PT-2026-99805

Name of the Vulnerable Software and Affected Versions Wireshark versions prior to 4.6.9 Description Multiple issues exist across protocol dissectors, capture-file parsers, the Sharkd utility, and configuration-profile handling, affecting protocols such as ZigBee, SCTP, IEEE 802.11, USB HID, and...

openSUSE 16: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (openSUSE-SU-2026:21700-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21700-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

Wazuh update_master_files_in_worker RCE

The vulnerability of the updatemasterfilesinworker function on the platform for security monitoring and threat detection by Wazuh is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to root an...

Windows DNS Code Execution

The vulnerability of DNS servers on Windows operating systems is related to the use of memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

su-exec Heap Buffer Overflow Privilege Escalation

The vulnerability of the strtol function in the su-exec utility is related to incorrect conversion of numerical types. Exploiting this vulnerability can allow an attacker to elevate their privileges to root and execute arbitrary code...

MiracleLinux 8 : libxml2-2.9.7-21.el8_10.7 (AXSA:2026-1714:07)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1714:07 advisory. libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow CVE-2026-11979 Tenable has extracted the preceding description block...

openSUSE 16: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (openSUSE-SU-2026:21699-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21699-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21703-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

openSUSE 16: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (openSUSE-SU-2026:21701-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21701-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

MiracleLinux 8 : mingw-sqlite-3.26.0.0-3.el8_10 (AXSA:2026-1713:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1713:01 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 Tenable has extracted the preceding description block directly...

RHEL 8 : wget (RHSA-2026:62144)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62144 advisory. The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols. Security Fixes: wget: GNU Wget: Memory...

Arbitrary Code Injection

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Arbitrary Code Injection in the /prompts/test endpoint through the renderedcontent path in litellm/proxy/prompts/promptendpoints.py. An attacker can execute arbitrary OS...