PT-2026-89733

It was discovered that Beets incorrectly escaped untrusted media metadata in its web interface. An attacker could possibly use this issue to inject arbitrary HTML or execute arbitrary JavaScript code in a user's browser...

RHEL 10 : rsyslog (RHSA-2026:66405)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66405 advisory. The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering ...

Linux Distros Unpatched Vulnerability : CVE-2026-74761

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authenticated client can spoof...

CVE-2026-15820: Improper Neutralization of Input During Web Page Generation

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

JetBrains IntelliJ IDEA < 2026.2.2 Information Disclosure (CVE-2026-86501)

The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.2.2. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log. CVE-2026-86501 Note that Nessus has no...

The vulnerability of Adobe Illustrator, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the Adobe Illustrator graphic editor is related to insufficient verification of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

postgresql16-postgis security update

3.5.3-4.1 - Fix CVE-2026-73515: validate flatgeobuf input buffers before decoding...

PT-2026-89378

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

ROS-20260910-73-0141

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a malicious file...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-8716-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8716-1 advisory. It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An...

ROS-20260910-73-0108

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise data integrity remotely...

CVE-2026-79590

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash...

VulnCheck KEV: CVE-2026-51990

Sogou Input Method contains a chain of three weaknesses that, if successfully exploited, could allow remote code execution. An attacker could exploit this vulnerability by convincing a user to click a specially crafted link...

GHSA-WCJJ-9M6G-2FR2 functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

K000163275: Curl vulnerabilities CVE-2023-27533, CVE-2023-28319, CVE-2023-28320, and CVE-2023-38039

Security Advisory Description CVE-2023-27533 A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allo...

Security Bulletin: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core

Summary Upgrade to new jsonListener.jar Vulnerability Details CVEID:CVE-2026-13006 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing...

DEBIAN-CVE-2026-79516

An out-of-bounds read in the stbspvsnprintf function stbsprintf.h of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service DoS via sending a crafted input...

Security Bulletin: IBM Informix HQ affected by Vulnerabilities (CVE-2026-6790, CVE-2025-11143, and CVE-2026-2332) in third-party library Jetty.

Summary IBM InformixHQ is affected by several vulnerabilities in Jetty. IBM InformixHQ has been updated to use the latest Jetty release. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request...

CVE-2026-87012 Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/openwebui/models/calendar.py stored the calendar event meta.alertminutes value without type validation and the shared upcoming-event scheduler compared that value numerically. An...