CVE-2026-7818

CVE-2026-7818 affects pgAdmin 4: Unsafe deserialization in FileBackedSessionManager allows an authenticated user with write access to the sessions directory to craft a payload that could lead to operating-system level remote code execution under the pgAdmin process identity. The root cause is des...

CVE-2026-7818 pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

CVE-2026-7818 pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

CVE-2026-7819 pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write

Symbolic-link path traversal CWE-61, CWE-22 in pgAdmin 4 File Manager. checkaccesspermission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storag...

CVE-2026-7818 pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

CVE-2026-7815 pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields bufferusagelimit, vacuumparallel, vacuumindexcleanup, reindextablespace were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with th...

PT-2026-39640

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization a...

TencentOS Server 4: kernel (TSSA-2026:0287)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0287 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-4897 affecting package polkit for versions less than 123-4

CVE-2026-4897 affecting package polkit for versions less than 123-4. A patched version of the package is available...

OSGeo gdal 缓冲区错误漏洞

OSGeo GDAL is an open-source geospatial raster and vector data processing library developed by OSGeo. Versions of OSGeo GDAL 3.13.0dev-4 and earlier contain a buffer error vulnerability. This vulnerability stems from a function in the Grid File Handler component, specifically the function...

python311-Django4-4.2.30-2.1 on GA media (moderate)

python311-Django4-4.2.30-2.1 on GA media Announcement ID: openSUSE-SU-2026:10708-1 Rating: moderate Cross-References: CVE-2026-35192 CVE-2026-5766 CVE-2026-6907 CVSS scores: CVE-2026-35192 SUSE : 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVE-2026-35192 SUSE : 2.3...

[SECURITY] [DLA 4572-1] linux security update

Debian LTS Advisory DLA-4572-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings May 08, 2026 https://wiki.debian.org/LTS Package : linux Version : 5.10.251-4 CVE ID : CVE-2026-43284 CVE-2026-43500 Two vulnerabilities have been discovered in the Linux kernel that may...

GDAL 缓冲区错误漏洞

GDAL is an open-source geospatial data abstraction library developed by GDAL. Versions of GDAL 3.13.0dev-4 and earlier contain a buffer error vulnerability. This vulnerability stems from the operation of the parameter DataFieldName in the function GDnentries within the file...

CVE-2026-34001 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4

CVE-2026-34001 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...

CVE-2026-33999 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4

CVE-2026-33999 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...

CVE-2026-34003 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4

CVE-2026-34003 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-4. A patched version of the package is available...

RHCOS 4 : OpenShift Container Platform 4.5.27 (RHSA-2021:0034)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0034 advisory. - jenkins-2-plugins/subversion: XML parser is not preventing XML external entity XXE attacks CVE-2020-2304 -...

RHCOS 4 : OpenShift Container Platform 4.9.25 (RHSA-2022:0860)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:0860 advisory. - CRI-O: Arbitrary code execution in cri-o via abusing kernel.corepattern kernel parameter CVE-2022-0811 Note that Nessus has not tested for...

RHCOS 4 : OpenShift Container Platform 4.2.29 openshift (RHSA-2020:1527)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1527 advisory. - kubernetes: Use of unbounded 'client' label in apiserverrequesttotal allows for memory exhaustion CVE-2020-8552 Note that Nessus has not...

RHCOS 4 : OpenShift Container Platform 4.6.23 (RHSA-2021:0956)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0956 advisory. - golang: data race in certain net/http servers including ReverseProxy can lead to DoS CVE-2020-15586 - golang: ReadUvarint and...