pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Tatsh bincookie buffer error vulnerability

Versions of Tatsh bincookie prior to 0.1.9 contain a buffer error vulnerability. This vulnerability stems from the bincookieinitfile function in bincookie.h, which allocates buffers based on the actual length of the .binarycookies file. However, it uses the numpages field of the file as the loop...

Telegram numerical error vulnerability

Telegram version 6.6.2 has a numerical error vulnerability, which stems from the rlottie library’s numerical truncation errors. There is a lack of proper validation of the data provided by users. This can lead to data being written before the allocated buffer starting position. Attackers can...

HPE NonStop Kernel Level Thread Model Lib buffer error vulnerability

The HPE NonStop Kernel Level Thread Model Lib T1132L01 version contains a buffer error vulnerability. This vulnerability stems from a stack buffer overflow and may lead to arbitrary code execution...

WebPros SolusVM 2: Code Injection Vulnerability

WebPros SolusVM 2 2.0.0-44576 and earlier versions have a code injection vulnerability. This vulnerability stems from server-side template injection, which may allow remotely authenticated users with root privileges to execute arbitrary code...

Ansible code injection vulnerability

Ansible has a code injection vulnerability stemming from Jinja2 template injection. Low-privilege Kubernetes users can craft malicious custom resource specification values, causing embedded Jinja2 expressions to execute within operator pods. This may lead to arbitrary code execution and privilege...

TotalSecurity TotalAV has a path traversal vulnerability

TotalSecurity TotalAV versions 7.1.17 and earlier have a security vulnerability. This vulnerability stems from an issue with local privilege escalation, allowing non-privileged local users to forge GRPC IPC authentication tokens by loading IPC.dll. These users can then abuse the SYSTEM service in...

Amazon Neptune Engine deserialization injection vulnerability

A security vulnerability exists in Amazon Neptune Engine versions from 1.2.0.0 up to but including 1.5.0.0. This vulnerability stems from the Gremlin graph data import component’s deserialization of untrusted data, potentially allowing authenticated remote attackers with standard database...

Siemens Software Center: Permissions, licensing, and access control issues

The Siemens Software Center has vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the loading of dynamic link libraries DLLs from uncontrolled search paths. This could allow authenticated local attackers to place malicious DLLs in the application’...

CVE-2026-92892

A flaw was found in JFrog CLI. Under specific configurations, a remote attacker can achieve arbitrary code execution on the host running the utility by exploiting improper command argument handling. Successful exploitation allows the attacker to run unauthorized commands within the context of the...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

EUVD-2026-101106

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

[SECURITY] [DSA 6560-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6560-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

CVE-2026-101337

A flaw was found in NSD Name Server Daemon. When parsing DNS zone files containing base64-encoded data formatted in segments of three characters or fewer, NSD incorrectly calculates token sizes, resulting in a stack-based buffer overflow. An attacker who can supply or manipulate a zone file loade...

RLSA-2026:81522 Important: pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fixes: pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular...

DEBIAN-CVE-2026-101341

Tokens of text in RDATA of for example TXT records under 32 bytes are not checked to stay within the space reserved for the RDATA allowing for arbitrary sized out of bound stack writes, including an overwrite of a callback function pointer which is called directly after parse. Zone files which ar...

Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...