RockyLinux 9 : tesseract (RLSA-2026:95086)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:95086 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffer...

UBUNTU-CVE-2026-122329

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw in src/decoderaiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwrites roughly 1 KB of adjacent stack memory when decoded, causing...

CVE-2026-123321: JetBrains WebStorm: In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted…

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects...

CVE-2026-123278: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint...

CVE-2026-123841: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive...

CVE-2026-123852: JetBrains Junie GitHub Action: In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates...

UBUNTU-CVE-2026-121994

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetchregisterusingp, which decodes a stub's register reply into an alloca-sized buffer without bounding writes b...

UBUNTU-CVE-2026-123095

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe to open file:// or av:// inputs, reading loca...

RHEL 9 : Satellite 6.18 (RHSA-2026:95657)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95657 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described...

RHEL 9 : Satellite 6.17 (RHSA-2026:95656)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95656 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described...

CVE-2026-92895: jiangweifang Live2DWebCanvas: The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...

UBUNTU-CVE-2026-121997

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to writ...

VulnCheck KEV: CVE-2026-118423

The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution...

RHEL 9 : Satellite 6.19 (RHSA-2026:95652)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95652 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described...

AlmaLinux 8 : tesseract (ALSA-2026:95725)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:95725 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffer...

CVE-2026-123293: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting...

CVE-2026-104657: Progress Software Fiddler Download & Setup Skill: Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows…

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at ...

RHEL 8 / 9 : Satellite 6.16 EUS (RHSA-2026:95655)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95655 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities describe...

CVE-2026-123280: JetBrains Datalore: In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports...

HPESBVS05168 rev.1 - HPE VM Essentials Software, Multiple Vulnerabilities

Potential Security Impact: Remote: Code Execution, Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Morpheus Software - VM Essentials HPE VME 9.0 9.0.2 HPE Morpheus Software HPE VME 9.0 9.0.2 - N/A HPE Morpheus Software - Advanced HPE VME 9.0 9.0.2 - N/...