Security Advisory Ivanti Endpoint Manager (EPM) May 2026

Security Advisory Ivanti Endpoint Manager EPM CVE-2026-8109, CVE-2026-8110, CVE-2026-811 Summary Ivanti has released updates for Ivanti Endpoint Manager which addresses one Medium severity and two High severity vulnerabilities. Successful exploitation could lead to information disclosure, privile...

CVE-2026-57863

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-57863

Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...

EUVD-2026-65478

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-57909

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system...

gstreamer1-plugins-good security update

An update is available for gstreamer1-plugins-good. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

python-urwid security update

An update is available for python-urwid. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

gstreamer1-plugins-good security update

An update is available for gstreamer1-plugins-good. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...

CVE-2026-57910 WatchGuard Agent improper authentication allows unauthenticated remote code execution

Improper authentication in the WatchGuard Agent allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges...

CVE-2026-57910

CVE-2026-57910 affects the WatchGuard Agent , where an improper authentication flaw allows an unauthenticated attacker with network access to cause the agent to execute arbitrary code with elevated privileges . The vulnerability is rated CVSS 4.0: 9.3 (CRITICAL) , with a network attack vector, lo...

CVE-2026-57909 WatchGuard Agent path traversal allows unauthenticated remote code execution

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system...

CVE-2026-57909

CVE-2026-57909 is a path traversal vulnerability in WatchGuard Agent that allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system. No user interaction or special privileges are required. The CVSS 4.0 base score is 9.4 (CRITICAL) , reflectin...

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-79657

NLTK (Python Natural Language Toolkit) versions before 3.10.3 are affected by a remote code execution vulnerability in its allowlisted pickle deserialization mechanism. The root cause is that the safe pickle loaders trust entire module namespaces rather than restricting to specific safe callables...

EUVD-2026-65440

NLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead of specific safe callables. Attackers can craft malicious pickle payloads invoking dangerous in-namespace functions like ReppTokenizer.execute and...

EUVD-2026-65463

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-19949

The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....

CVE-2026-16723

A flaw was found in fastjson. This remote code execution RCE vulnerability allows a remote attacker to execute arbitrary code on the system. The vulnerability is exploitable under fastjson's default configuration, meaning no special setup or AutoType enablement is required for exploitation...

CVE-2026-77138

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...