HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under...

D-Link NTP Service Arbitrary Command Execution

The vulnerability of the handlerupdatesystemtime function libdeuteronmodules.so of the NTP Service component of D-Link DIR-825 and DIR-825R routers is related to the lack of measures taken to protect data at the management level. Exploiting this vulnerability could allow a remote attacker to...

Langflow agent creation and deployment tool CORS Code Execution

The vulnerability of the CORS configuration mechanism used by the Langflow agent creation and deployment tool is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-47424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, GroovySandboxValueFilter permits an authenticated server-side script author to...

CVE-2026-92592: Improper Neutralization of Special Elements Used in a Template Engine

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, which a script can use to link an...

Path traversal vulnerability in robot

robot 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller. This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file...

PT-2026-93358

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

PT-2026-93373

Name of the Vulnerable Software and Affected Versions NLnet Labs Unbound versions prior to 1.26.1 Description A heap-based buffer overflow exists in the DNSSEC validator of the Unbound DNS resolver. The issue occurs during the preparation of a DNSKEY digest within the ds create dnskey digest...

RHEL 9 : gstreamer1-plugins-base (RHSA-2026:67892)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67892 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

RHEL 10 : libevent (RHSA-2026:67909)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67909 advisory. The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service v...

Linux Distros Unpatched Vulnerability : CVE-2026-81642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in the DNSSEC validator that enables denial of service and possible remote code...

CVE-2026-27556: Improper Control of Filename for Include/Require Statement in PHP Program

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555: Improper Control of Filename for Include/Require Statement in PHP Program

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

RHEL 9 : kernel (RHSA-2026:67720)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67720 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/mana: Remove user...

Jenkins plugins Multiple Vulnerabilities (2026-09-16)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes,...

Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment

Overview A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This...

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

CVE-2026-61590: Missing Authentication for Critical Function

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

(0Day) MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the OpenBBtable class. The issue results from the lack of proper validation of a user-supplied strin...