VulnCheck KEV: CVE-2026-47670

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...

Security Advisory 0203

Security Advisory 0203 PDF Date: November 2, 2026 Revision | Date | Changes ---|---|--- 1.0 | November 2, 2026 | Initial release 1.1 | November 3, 2026 | Remove Wifi-AP from affected products to unaffected products. Move additional products from under triage to unaffected products. The CVE-ID...

PT-2026-135448

Name of the Vulnerable Software and Affected Versions Netpbm versions prior to 10.86.51 Netpbm versions prior to 11.02.30 Netpbm versions prior to 11.15.08 Description Multiple issues exist in the software that can lead to crashes or remote code execution when processing crafted files. In the...

CVE-2026-120432: Netpbm: Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows…

Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows attackers to corrupt heap memory via oversized ICO/CUR dimensions. Attackers can supply a crafted icon file with width or height above 32767, wrapping int16t loop counters into...

PT-2026-135425

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expressi...

CVE-2026-16306: INFINITT Healthcare System Manager: Remote Code Execution in the `IModular.exe` URI handler in INFINITT Healthcare Co., Ltd

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities

Overview INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5. Description INFINITT PACS is an...

PT-2026-135452

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg dec merge planes overflows...

PT-2026-135262

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile. Attackers can create a file record via file.createFile with a traversal name, then trigger document parsin...

Node.js 24.22.0 Brotli Decoder Remote Code Execution

Node.js version 24.22.0 contains an out-of-bounds write in the Brotli decoder. A proof of concept demonstrates remote code execution through a crafted Brotli-compressed HTTP request. https://packetstorm.news/download/238892...

bind security, bug fix, and enhancement update

32:9.11.36-18 - CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay 32:9.11.36-17 - CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages processing of crafted DNS messages 32:9.11.36-16.17 - Backport additional checks for th...

bind9.16 security update

32:9.16.23-0.22.21 - CVE-2026-94300 bind9.16: bind: Arbitrary code execution via GSS-TSIG UDP message replay 32:9.16.23-0.22.20 - CVE-2026-97313 bind9.16: bind: Denial of service via assertion failure in RPZ query processing 32:9.16.23-0.22.19 - CVE-2026-96888 bind9.16: bind: Denial of Service vi...

D-Link DIR-505 Wireless Router Code Execution

The vulnerability in the main function of the /secmark1524.cgi script within the Web Management CGI interface of the D-Link DIR-505 wireless router software is related to the presence of undocumented configuration commands. Exploitation of this vulnerability may allow a remote attacker to execute...

GFX Component Code Execution

The vulnerability in the GFX component of Google Chrome and Microsoft Edge is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

GeoDjango Spatial Search Code Execution

The spatial search vulnerability in the GeoDjango software platform for Django web applications is related to improper external handling of filenames or file paths. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Incus Container Management System Code Execution

The vulnerability in the Incus container management system and virtual machine manager is related to an incorrect file access reference. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Google Chrome Code Execution

The Accessibility component vulnerability in Google Chrome is related to a buffer overflow in memory. Exploitation of this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

Payments component Code Execution

The vulnerability in the Payments component of Google Chrome and Microsoft Edge is related to use-after-free memory usage. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

RHEL 8 : libxml2 (RHSA-2026:93463)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93463 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: mingw-libxml2:...

RHEL 8 : libxml2 (RHSA-2026:93473)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93473 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer...