RHEL 7 : libxml2 (RHSA-2026:93791)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93791 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2:...

Debian dla-4878 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4878 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4878-1 [email protected]...

CVE-2026-120438: QuickJS-NG: QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a…

QuickJS-NG before 0.16.0 contains an integer overflow in jsproxygetownpropertynames in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or potentia...

Apache Camel AWS2S3Utils Code Execution

The vulnerability in the AWS2S3Utils.determineKey function within the camel-aws2-s3 component of the Apache Camel Java framework is related to improper handling of special elements used in the expression language operator. Exploitation of this vulnerability may allow a remote attacker to execute...

Google Chrome Microsoft Edge Code Execution

The vulnerability in the Bluetooth components of Google Chrome and Microsoft Edge is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted Chrome extension...

WebUSB Component Code Execution

The vulnerability in the WebUSB component of Google Chrome and Microsoft Edge is related to use-after-free memory usage. Exploitation of this vulnerability may allow an attacker to execute arbitrary code via a malicious peripheral device...

NGINX Map Directive Code Execution

The vulnerability in the Map Directive component of NGINX Plus and NGINX Open Source web servers is related to use-after-free memory allocation. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service or execute arbitrary code...

CVE-2026-120315: lobehub chat: LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to…

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile. Attackers can create a file record via file.createFile with a traversal name, then trigger document parsin...

Linux Distros Unpatched Vulnerability : CVE-2026-104065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y...

Linux Distros Unpatched Vulnerability : CVE-2026-104066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit...

RHEL 10 : libXi (RHSA-2026:93441)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93441 advisory. X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090...

ALSA-2026:93439 Important: libXi security update

X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow CVE-2026-109089 For more details about the security issues, including the...

ALSA-2026:93925 Important: bind security, bug fix, and enhancement update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

PT-2026-135356

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...

libXi security update

1.8.1-7.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293447 1.8.1-7.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293391...

ALSA-2026:93438 Important: libXi security update

X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow CVE-2026-109089 For more details about the security issues, including the...

Rocky Linux 9 [CIQ] Security Update: bind9.18 / bind9.18-chroot / bind9.18-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_93072)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202693072 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP messag...

WordPress 7.0.1 REST API Batch Route Confusion Remote Code Execution

WordPress version 7.0.1 contains a REST API batch-route confusion issue which, when chained with an authornotin SQL injection issue, can allow unauthenticated remote code execution. This submission provides a proof of concept report for the wp2shell vulnerability chain...

RHEL 9 : perl-HTTP-Daemon (RHSA-2026:93586)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93586 advisory. The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers...

Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...