ROS-20261002-73-0034

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0032

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0021

The vulnerability of the PostgreSQL database management system is related to errors in data type mixing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Fedora 45 : 0ad / GAPDoc / GConf2 / GraphicsMagick / ImageMagick / Io-language / etc (2026-91259c13b9)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-91259c13b9 advisory. libxml2 updated to version 2.15.4, compat libxml22.13 added, and rebuilds of packages linking to libxml2. Packages that FTBFS will require the compa...

SUSE SLES12 Security Update : python-PyYAML (SUSE-SU-2026:4402-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4402-1 advisory. - Update to 5.3.1. - CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code...

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21983-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21983-1 advisory. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204:...

The vulnerability of the ThreadPoolOptions component in the Piscina library of the Node.js software platform allows a hacker to execute arbitrary code.

The vulnerability of the ThreadPoolOptions component in the Piscina library of the Node.js software platform is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20261002-73-0022

The vulnerability of the PostgreSQL database management system is related to errors in data type mixing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

Debian dsa-6540 : radsecproxy - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6540 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6540-1 [email protected] https://www.debian.org/security/ Moritz...

Debian dsa-6538 : redis - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6538 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6538-1 [email protected] https://www.debian.org/securit...

MiracleLinux 9 : postgresql:15 (AXSA:2026-1952:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1952:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

PT-2026-104411

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.17 Description A code execution issue exists in the Java integration of the software. A crafted untrusted document can trigger the execution of arbitrary code, including remote code, when opened by a use...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

foreman: command injection in foreman-rake errors:fetch_log via request_id parameter

A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...

GitPython: GitPython: Arbitrary code execution via improper validation of clone options

A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...

GitPython: GitPython: Arbitrary code execution via improper validation of clone options

A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...