Important: Red Hat Security Advisory: redis security update

An update for redis is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-91827 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

CVE-2026-91827

The Ninja Forms WordPress plugin (version 3.15.3 ) is vulnerable to unauthenticated PHP Object Injection . User-submitted form field values are deserialised without sanitisation when an administrator exports form submissions to CSV . Exploitation requires user interaction (an admin performing the...

Exploit for CVE-2026-19658

CVE-2026-19658 — Give Tributes Unauthenticated PHP Object Inje...

redis: Redis: Remote Code Execution via specially crafted RESTORE payload

A flaw was found in Redis. An authenticated attacker, in an unusual configuration where they can execute the RESTORE command, could exploit a double free vulnerability. This occurs when a specially crafted RESTORE payload references the same NACK pending entry by multiple consumers, and both...

Important: Red Hat Security Advisory: redis security update

An update for redis is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and called "Comment2Shell ," on...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

USN-8799-1 libssh2 vulnerabilities

It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. CVE-2026-58050 It was discovered that libssh2 did not properly...

USN-8799-1: libssh2 vulnerabilities

It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code. CVE-2026-58050 It was discovered that libssh2 did not properly...

EUVD-2026-84241

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

ROS-20260922-73-0135

The vulnerability in postgresqlanonymizer17 is related to the failure to implement proper protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2026-090073)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090073 advisory. Apache HTTP server 2.4.32 to 2.4.44 modproxyuwsgi info disclosure and possible RCE Tenable has extracted the preceding description block directly from the Unity Linu...

CVE-2026-88419

WuzhiCMS version 5.0.0 is vulnerable to an unrestricted file upload via the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload). The application fails to perform content validation or use an extension allowlist, taking the file extension verbatim from the client-supplied filen...

CVE-2026-87902: Improper Control of Filename for Include/Require Statement in PHP Program

An unauthenticated attacker can make getpagetemplate page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...

CVE-2026-16672: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-83603: External Control of File Name or Path

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socketpath from the low-privileged netdata service account. The account can direct root fail2ban-client...

VulnCheck KEV: CVE-2026-87902

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local .php file outside the active theme directories, leading to remote code execution...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-054027)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054027 advisory. In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametriz...

CVE-2026-88419: Unrestricted Upload of File with Dangerous Type

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...