AlmaLinux 10 : postgresql18 (ALSA-2026:67280)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67280 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

AlmaLinux 9 : postgresql:16 (ALSA-2026:67491)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67491 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrar...

PT-2026-95063

Name of the Vulnerable Software and Affected Versions FaustWP versions prior to 1.8.11 Description The FaustWP WordPress plugin fails to include the 16-byte initialization vector in the HMAC Hash-based Message Authentication Code, a mechanism for verifying data integrity within the encrypt and...

AlmaLinux 9 : postgresql:18 (ALSA-2026:67848)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67848 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

Deserialization of Untrusted Data

Overview kedro-datasets is a Kedro-Datasets is where you can find all of Kedro's data connectors. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the PyTorchDataset process. An attacker can execute arbitrary code by supplying a malicious .pt model file fro...

CVE-2026-62997 Kedro-Datasets: Remote code execution in experimental `PyTorchDataset` via unsafe `torch.load`

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedrodatasetsexperimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weightsonly=True, and user-supplied loadargs are silently dropped. On PyTorch versions...

CVE-2026-62997

Kedro-Datasets provides data connectors for Kedro. From version 5.0.0 until 9.5.0, kedrodatasetsexperimental.pytorch.PyTorchDataset in kedro-datasets loads .pt model files with torch.load without enforcing weightsonly=True, and user-supplied loadargs are silently dropped. On PyTorch versions...

CVE-2026-20324 Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary commands as root. This vulnerability exists because a registered sftunnel peer has incorrect permissions t...

CVE-2026-63325

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

Important: Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.4 Security Update

Red Hat Edge Manager Version 1.1.4 Security Update Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports image-mode RHEL and container workloads that run on Podman/Docker or Kubernetes. RHEM is now available as a...

RLSA-2026:67848 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

Directory Traversal

Overview stanza is an A Python NLP Library for Many Human Languages, by the Stanford NLP Group Affected versions of this package are vulnerable to Directory Traversal via the unzip function in the resource extraction process. An attacker can overwrite files outside the intended directory and...

SUSE CVE-2026-91711

Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91715

Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91727

Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

SUSE CVE-2026-91731

Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-91734

Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

SUSE CVE-2026-91741

Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2026-92248

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection in the @GroovyASTTransformationClass annotation...