PT-2026-98867

Name of the Vulnerable Software and Affected Versions Gnumeric affected versions not specified Description A heap use-after-free flaw exists where the XML parser can dereference a freed sheet-object component. This occurs when a user opens a specially crafted workbook containing a malformed...

PT-2026-98350

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.08 Description The ticket email parser, located at the endpoint 'cron/ticket email parser.php', allows SVG attachments in email messages received via SMTP from arbitrary senders. Recommendations Update to version...

The vulnerability of the SCRAM (Salted Challenge Response Authentication Mechanism) mechanism in the PostgreSQL PgBouncer connection pool allows a attacker to induce a service failure.

The vulnerability of the SCRAM Salted Challenge Response Authentication Mechanism mechanism in the PostgreSQL PgBouncer connection pool lies in the dereferencing of pointers due to the lack of validation for a required attribute in the end-message parser. Exploiting this vulnerability allows a...

Linux Distros Unpatched Vulnerability : CVE-2026-19888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to...

PT-2026-99014

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

CVE-2026-97222: Use After Free

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash...

PT-2026-98805

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethosu accelerator driver where the command stream parser incorrectly interprets bits 15:14 of NPU SET IFM,OFM PRECISION as an activation storage mode on U65...

CVE-2025-1218: Heap-based Buffer Overflow

The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and c...

CVE-2026-91765: Uncontrolled Recursion

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...

Linux Distros Unpatched Vulnerability : CVE-2026-88382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hiredis commit 29ea279 post-v1.5.0 contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. CVE-2026-88382 Note that Nessus relies...

CliInvoke: Argument Injection in Extensibility Runner Factory

An argument-injection vulnerability exists in the CliInvoke package's runner factory: RunnerProcessFactory on the 2.x line and RunnerConfigurationFactory on the 3.x line. The factory joins the runner arguments, the caller's target, and the caller's arguments into a single ProcessStartInfo.Argumen...

CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers

An OS command injection vulnerability exists in the PowerShell and Cmd shell wrappers provided by the CliInvoke.Specializations package the PowershellProcessInvoker/CmdProcessInvoker invokers, and the UsePowerShell/UseCmd middleware in v3 pre-release versions. The wrappers re-run a caller-supplie...

Linux Distros Unpatched Vulnerability : CVE-2026-97222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML...

Linux Distros Unpatched Vulnerability : CVE-2026-59990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a...

Linux Distros Unpatched Vulnerability : CVE-2026-61814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks...

Linux Distros Unpatched Vulnerability : CVE-2026-93213

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property...

openSUSE 16 Security Update : gdb (openSUSE-SU-2026:21890-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21890-1 advisory. This update for gdb fixes the following issue: - CVE-2026-13732: out-of-bounds write in STABS parser readmemberfunctions via crafted ELF bsc1277757...

Linux Distros Unpatched Vulnerability : CVE-2026-88358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded. A specially crafted truncated JSON document whose final...

Linux Distros Unpatched Vulnerability : CVE-2026-67415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter valu...

SUSE CVE-2026-93213

In the Linux kernel, the following vulnerability has been resolved: of: fix out-of-bounds read in ofaliasscan stem parser The stem parser tests isdigitend - 1 before checking end start and so reads one byte before the property name when the name is empty or all digits. Check the bound first...