MiracleLinux 9 : webkit2gtk3-2.54.1-1.el9_8 (AXSA:2026-2100:10)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2100:10 advisory. chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read CVE-2026-87596 chromium-browser: angle: ANGLE in Goog...

PT-2026-118251

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server...

PT-2026-118319

A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution...

Totolink X2000R boa formWsc targetAPSsid OS command injection vulnerability

Summary A OS command injection vulnerability exists in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R boa formParentControl url stack-based buffer overflow vulnerability

Summary A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to...

Red Hat: CVE-2026-86922: webkitgtk: WebKitGTK: Arbitrary code execution via type confusion

A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution...

postgresql:16 security update

pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pgrepack 1.5.1-1 - Update to v1.5.1 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 1.4.8-1 - Resolves: RHEL-3636 - Initial import for PG 16...

postgresql:18 security update

pgaudit 18.0-1 - Update to 18.0 - Initial import for postgresql18 pgrepack 1.5.3-1 - Update to 1.5.3 - Initial import for postgresql18 1.5.1-1 - Update to v1.5.1 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 pgvector 0.8.7-1 - Update to 0.8.7 - Fixes...

Google Chrome resource management error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a resource management error vulnerability. This vulnerability stems from a use-after-free issue in DevTools, which may allow remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

Google Chrome buffer error vulnerability

Google Chrome on Android versions prior to 156.0.8078.47 contains a buffer error vulnerability. This vulnerability stems from memory corruption in the History component, allowing remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

Google Chrome buffer error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a buffer error vulnerability. This vulnerability stems from memory corruption in DevTools, allowing remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

Vladimir Iakovlev The Fuck security vulnerability

Vladimir Iakovlev: Version 3.32 of The Fuck contains a security vulnerability. This vulnerability stems from improper handling in getrulesimportpaths within thefuck/corrector.py file and Rule.frompath in thefuck/types.py file, potentially allowing local attackers to execute arbitrary code...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : PHP vulnerabilities (USN-8936-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8936-1 advisory. It was discovered that PHP did not properly validate the size of MySQL...

Totolink X2000R boa formPasswordSetup OS command injection vulnerability

Summary An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Google Chrome buffer error vulnerability

Google Chrome versions prior to 156.0.8078.47 contain a buffer error vulnerability. This vulnerability stems from memory corruption in DevTools, which may allow remote attackers to execute arbitrary code within the sandbox via specially crafted HTML pages...

PT-2026-118604

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-118605

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-120141

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper bounds checking leads to a stack-based buffer overflow, which occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold. Th...

PT-2026-118595

Name of the Vulnerable Software and Affected Versions Acrobat for Edge versions prior to 154.0.4258.48 Description An out-of-bounds write issue exists that could allow arbitrary code execution in the context of the current user. This occurs when a victim opens a malicious file, requiring user...

PT-2026-118664

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp dns functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...