PT-2026-95328

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description Improper file validation controls lead to an unrestricted file upload issue. This allows an unauthenticated attacker to upload and execute malicious payloads, which can...

ROS-20260918-73-0020

The vulnerability of the net/bluetooth/l2capcore.c component in the Linux operating system is related to incorrect checking of the data size at the input stage. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

ROS-20260918-73-0044

The vulnerability of the mptcpsubflowinit function in the net/mptcp/protocol.c module of the Linux kernel relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

ROS-20260918-73-0007

The vulnerability of the mtkmdpprobe function in the drivers/media/platform/mediatek/mdp/mtkmdpcore.c file of the Linux kernel’s multimedia device driver is related to unsynchronized access to shared data in a multi-threaded context. Exploiting this vulnerability could allow an attacker to...

ROS-20260918-73-0077

The vulnerability of the efivarentryget function in the fs/efivarfs/vars.c file of the Linux kernel file system is related to deficiencies in error handling. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

PT-2026-95645

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The create partition time function reads the time encoder value from the part config table and interpolates it into a dynamically executed SELECT statement without proper identifier quoting. A use...

PT-2026-95649

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The inherit template properties function manually surrounds primary-key column names from pg attribute.attname with double quotes without escaping embedded double-quote characters. A user with...

ROS-20260918-73-0121

The vulnerability of the rsimac80211attach function in the drivers/net/wireless/rsi/rsi91xmac80211.c driver for wireless communication adapters in the Linux kernel is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to...

CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

ROS-20260918-73-0090

The vulnerability of the mtkxdpsetup function in the drivers/net/ethernet/mediatek/mtkethsoc.c file of the network adapter driver for mediatek in the Linux operating system is related to the lack of memory release after the effective lifespan of the function. Exploiting this vulnerability could...

Oracle Analytics Server (OAS 26.01) (September 2026 CSPU)

The version of Oracle Analytics Server 26.01.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web...

CVE-2026-56590: Unrestricted Upload of File with Dangerous Type

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise...

PT-2026-95648

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description When pg jobmon is installed and part config.jobmon is set to true, exception handlers in several functions place the p parent table variable verbatim into a SQL string literal used to call the pg...

CVE-2026-54646

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-54646

CubeCart (an ecommerce platform) is affected by a SQL identifier injection in admin/sources/maintenance.index.inc.php (line 551) prior to 6.7.5 . Administrator-supplied table names from POST parameters are wrapped in backticks and placed into structural SQL statements (ALTER TABLE, CHECK TABLE, A...

CVE-2026-54646 CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16272 Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16266 Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...