EUVD-2026-41815

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...

CVE-2026-14802 react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection

A vulnerability was detected in react create-react-app up to 5.0.1 on macOS. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The...

CVE-2026-14802

CVE-2026-14802 affects react-create-app releases up to 5.0.1 on macOS, targeting the startBrowserProcess function in openBrowser.js within react-dev-utils. The root cause is an input manipulation that enables OS command injection, with remote exploitation described as possible and the exploit pub...

ROS-20260706-73-0014

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0013

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0010

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0009

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0008

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

MiracleLinux 8 : rrdtool-1.7.0-17.el8_10 (AXSA:2026-1189:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1189:01 advisory. rrdtool: Stack buffer overflow in rrdcached handlerequestcreate allows local privilege escalation via unbounded DS/RRA arguments CVE-2026-43958 Tenable has...

ROS-20260706-73-0007

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0015

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0012

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

ROS-20260706-73-0011

The vulnerability of the CREATE TYPE command in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL functions remotely...

rrdtool security update

An update is available for rrdtool. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The round robin database RRD system stores and displays time-series data, suc...

Improper Authorization

electerm is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation of JSON payloads received through the single-instance socket/pipe, which allows a same-user local attacker to create tabs and execute attacker-controlled local processes without user interaction...

RockyLinux 8 : rrdtool (RLSA-2026:34155)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:34155 advisory. rrdtool: Stack buffer overflow in rrdcached handlerequestcreate allows local privilege escalation via unbounded DS/RRA arguments CVE-2026-43958 Tenable has...

CVE-2026-22555

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets...

Malicious code in @node-cloud/create (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e66147a84e0fc5236544fe38349b5a8cd03c3988695c485bd0e7c270dffd2cb2 index.js unconditionally requires @sql-trigger/nodesql at the top of the main file var ins = require'@sql-trigger/nodesql'; but never references the...

CVE-2026-58653 PraisonAI - Authorization Bypass via Unvalidated project_id in Issue Create/Update

PraisonAI before 0.1.7 fails to validate that projectid in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace...

CVE-2026-13125

GeoWebPlayer also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud is an addon that can be installed with various GeoVision software GV-VMS, GV-Cloud, .... It creates a websocket server that expands the capabilities of the various web-interfaces provided by the...