EUVD-2026-104721

A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2026-86922

A type confusion vulnerability exists in WebKitGTK and WebKit (used in Safari, iOS, iPadOS, macOS, and visionOS). The flaw occurs because the application misinterprets an object's data type in memory, which can be triggered by processing maliciously crafted web content . This issue could lead to ...

CVE-2026-86919

A stack overflow vulnerability exists in the Core Bluetooth component, which was addressed by implementing improved input validation. An attacker utilizing a paired Bluetooth device could potentially leverage this flaw to execute arbitrary code . This issue has been remediated in the following ve...

EUVD-2026-104719

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code...

CVE-2026-86919

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code...

CVE-2026-86919

A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code...

CLEANSTART-2026-ZY34480 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

Security vulnerability affects the grafana-fips package. SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass...

EUVD-2026-104675

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication...

EUVD-2026-104653

A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution...

EUVD-2026-104651

A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash...

EUVD-2026-104652

A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code...

CVE-2026-107400

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication...

Totolink X2000R boa formMapDelDevice macstr OS command injection vulnerability

Summary A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

Totolink X2000R Mcli stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerabilit...

Google Chrome buffer error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a buffer error vulnerability. This vulnerability stems from memory corruption in Passwords, which may allow remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

PT-2026-118292

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes...

ALSA-2026:85814 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build CVE-2026-103484 For more details about the security issues, including the impact, a CVSS score,...

Debian dla-4828 : gir1.2-gst-plugins-base-1.0 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4828 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4828-1 [email protected]...

RHEL 9 : postgresql:18 (RHSA-2026:85814)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:85814 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: pgvector: pgvector: Arbitrary code execution via...

RockyLinux 9 : emacs (RLSA-2026:85245)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:85245 advisory. emacs: Emacs: arbitrary code execution in Flymake mode CVE-2026-96442 Tenable has extracted the preceding description block directly from the RockyLinux security...