mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

CVE-2026-59088

A flaw was found in GIMP. A signed integer overflow vulnerability exists in the file-fli plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum intege...

CVE-2026-18401

A flaw was found in jackson-core. The non-blocking asynchronous JSON parser does not properly enforce the maximum number length constraint. A remote attacker can exploit this by submitting a specially crafted JSON document containing an arbitrarily long number to an application using the...

CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-72564 fosrl Pangolin - Access Token Scope Bypass Allows Cross-Resource Authentication

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organization by reusing an access token issued for a different resource...

Astra Linux – Vulnerability in mapserver

MapServer is a system for developing web-based GIS applications. Starting from version 4.2 and before version 8.6.1, a heap-buffer-overflow write in MapServer’s SLD Styled Layer Descriptor parser allowed a remote, unauthenticated attacker to crash the MapServer process by sending a crafted SLD...

Astra Linux – Vulnerability in Chromium

In V8 in Google Chrome, prior to version 147.0.7727.55, allowing remote attackers to potentially exploit heap corruption through a crafted HTML page was possible. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

In Google Chrome, policy bypass in the “Audio” section prior to version 147.0.7727.55 allowed a remote attacker who convinced a user to perform certain UI gestures to bypass sandbox download restrictions through a crafted HTML page. Chromium security severity: Low...

EUVD-2026-54983

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

The vulnerability of the maybe_fork_scalars() function in the fs/smb/server/smb2pdu.c module of the Smb subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the maybeforkscalars function in the fs/smb/server/smb2pdu.c module of the Smb subsystem in the Linux operating system is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to compromise t...

The vulnerability of the IP Protection component in the Firefox web browser and the Thunderbird email client allows attackers to access confidential data.

The vulnerability of the IP Protection component in the Firefox web browser and the Thunderbird email client relates to the disclosure of information. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data...

Photon OS 5.0: Python3 PHSA-2026-5.0-92-0910

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0910. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

The vulnerability of the api/store_javascript_cache.php file of the BerqWP plugin allows a hacker to execute arbitrary code.

The vulnerability of the api/storejavascriptcache.php file of the BerqWP plugin is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Photon OS 5.0: Postgresql13 PHSA-2025-5.0-91-0683

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0683. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Vulnerability of JavaScript components: Firefox’s WebAssembly browser allows attackers to access sensitive data and compromise its integrity

JavaScript component vulnerability: Firefox’s WebAssembly browser is vulnerable due to the implementation of incorrect flow control. Exploiting this vulnerability could allow a remote attacker to access sensitive data and compromise its integrity...

The vulnerability of the imageUploadHandle() function in the WPBookit plugin, a content management system for WordPress websites, allows a hacker to execute arbitrary code.

The vulnerability of the imageUploadHandle function in the WPBookit plugin of the WordPress content management system involves unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-15972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptan...

The vulnerability of the Cookies component in the Firefox web browser and the Thunderbird email client allows a hacker to trigger a service failure.

The vulnerability of the Cookies component in the Firefox web browser and the Thunderbird email client relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the `index_local_file_headers_within_bounds()` function in the `libclamav/unzip.c` file of the ClamAV antivirus program allows a hacker to execute arbitrary code and cause service failure.

The vulnerability of the indexlocalfileheaderswithinbounds function in the libclamav/unzip.c file of the ClamAV antivirus program is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code and cause service failures...

The vulnerability of the load balancer Progress Kemp LoadMaster, related to the failure to perform data cleaning at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the load balancing device Progress Kemp LoadMaster lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...