Ubuntu 24.04 LTS / 26.04 LTS : Valkey vulnerabilities (USN-8771-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8771-1 advisory. Madelyn Olson discovered that Valkey incorrectly handled TLS connections under certain conditions. A remote attacker could possibly use this...

RHEL 8 : gstreamer1-plugins-base (RHSA-2026:68503)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68503 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

Ubuntu 26.04 LTS : libheif vulnerabilities (USN-8774-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8774-1 advisory. Ali Firas discovered that libheif incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service or execute...

CVE-2026-62104: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

CVE-2026-81475: Missing Authentication for Critical Function

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

EulerOS 2.0 SP15 : perl-IO-Compress (EulerOS-SA-2026-3814)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.x000D...

CVE-2026-92946: Improper Control of Dynamically-Managed Code Resources

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes nodemodules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via...

CVE-2026-92980: Unrestricted Upload of File with Dangerous Type

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-52727: Use of Hard-coded Cryptographic Key

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-50158: External Control of File Name or Path

yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/caption/download.go and passes it to Caption.Download in pkg/caption/caption.go, where os.Create creates or truncates that...

CVE-2026-54626: Heap-based Buffer Overflow

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGAINDEXEDRLE path selected by imagetype == 9 allocates an image buffer using the one-byte-per-pixel SAILPIXELFORMATBPP8INDEXED format returned by...

CVE-2026-93373: Use After Free

Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: High...

CVE-2026-93374: Use After Free

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-71538: Improper Neutralization of Special Elements used in an OS Command

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

KLA91293 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Network can be...

RHEL 7 : vim (RHSA-2026:68711)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68711 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: arbitrary command execution via modeline sandbox...

EulerOS 2.0 SP15 : perl-IO-Compress (EulerOS-SA-2026-3789)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.x000D...

EulerOS 2.0 SP15 : sqlite (EulerOS-SA-2026-3798)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process...

AlmaLinux 9 : postgresql:16 (ALSA-2026:67491)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67491 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrar...

EulerOS 2.0 SP15 : openssl (EulerOS-SA-2026-3787)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: A signed integer overflow when sizing the destinationx000D buffer for Unicode output in ASN1mbstringncopy can lead to a heapx000D...