CVE-2026-19575: Access of Resource Using Incompatible Type

The user-mode verification handler for the devicedeinit system call, zvrfydevicedeinit in kernel/device.c, validated its dev argument with KSYSCALLOBJINITdev, KOBJANY. kobjectvalidate short-circuits its type comparison when the requested type is KOBJANY, so the check reduced to "this pointer is t...

CVE-2026-86851: Missing Authorization

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...

ROS-20261009-73-0091

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261009-73-0530

The vulnerability in the kernel-lt is related to integer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Cisco NX-OS NGOAM Protocol Code Execution

The vulnerability of the NGOAM protocol implementation in the Cisco NX-OS operating system for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series devices lies in the fact that operation data is written outside of the buffer in memory. Exploiting this vulnerability allows a malicious act...

Microsoft SQL Server Buffer Overflow

The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Windows Imaging Component Code Execution

The vulnerability of the Windows Imaging Component WIC framework in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

CVE-2026-92705: Improper Neutralization of Null Byte or NUL Character

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...

Microsoft SQL Server Buffer Overflow

The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Cisco NX-OS NGOAM Protocol Code Execution

The vulnerability of the NGOAM protocol implementation in the Cisco NX-OS operating system for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series devices lies in the fact that operation data is written outside of the buffer in memory. Exploiting this vulnerability allows a malicious act...

CVE-2026-78796

The Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (v1.3.241114.024540 and before) contains a vulnerability that allows a remote attacker to perform arbitrary code execution . The flaw is located in the www extbackslash cgi-bin\upgrade file. No specific remediation or explo...

CVE-2026-78797: Improper Control of Generation of Code

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the taskid in tasks-lib.lua...

HPESBST05160 rev.1 - HPE SAN Switches with Brocade Fabric OS (FOS) BSA-2026-3962, Multiple Vulnerabilities

Potential Security Impact: Local: Access Restriction Bypass, Arbitrary Code Execution, Escalation of Privilege, Buffer Overflow; Remote: Access Restriction Bypass, Arbitrary Code Execution, Bypass Security Restrictions, Denial of Service DoS, Unauthorized Access, Unauthorized Data Injection, Buff...

Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_77359)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202677359 advisory. vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion CVE-2026-73073 Tenable has extracted the preceding description block directly from...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791539516)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791539516 advisory. - A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly...

MiracleLinux 8 : postgresql:12 (AXSA:2026-2007:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2007:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql...

Linux Distros Unpatched Vulnerability : CVE-2026-94444

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to...

Cisco Application Policy Infrastructure Controller API Command Injection (cisco-sa-apic-cmdinj-L6VR4E7)

According to its self-reported version, Cisco Application Policy Infrastructure Controller APIC is affected by a vulnerability. - A command injection vulnerability exists in the web-based management API due to insufficient input validation of user-controlled command arguments. An authenticated,...

Linux Distros Unpatched Vulnerability : CVE-2026-107725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization chec...

Redis 5.0.7 Lua Sandbox Escape

Redis version 5.0.7 as packaged by Debian and Ubuntu leaves the Lua package global accessible, allowing EVAL scripts to load Lua's io module and execute host commands. The supplied environment and proof of concept demonstrate CVE-2022-0543. https://packetstorm.news/download/234982...