USN-8873-1: Unbound vulnerabilities

Yuqi Qiu and Xiang Li discovered that Unbound did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-81642 Ben Morris discovered that Unbound did not correctly handle certain memory operations...

MAL-2026-17636 Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS

IBM SECURITY ADVISORY First Issued: Tue Oct 6 01:00:55 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/postgresadvisory2.asc Security Bulletin: Multiple vulnerabilities in PostgreSQL affect PowerVM VIOS...

EUVD-2026-92811

In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This...

CVE-2026-105745

A flaw was found in Docling. Docling imports registered plugin entry points before evaluating whether external plugins are permitted. A local attacker or compromised package installed in the environment can exploit this flaw to achieve arbitrary code execution during startup, even when external...

PT-2026-107199

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An authenticated path traversal vulnerability exists in the command line interface. This flaw allows a low-privileged authenticated remote attacker to execute arbitrary code...

CVE-2026-106234: Use After Free

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: Low...

Debian dsa-6546 : rails - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6546 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6546-1 [email protected] https://www.debian.org/securit...

Security Advisory 0193

Security Advisory 0193 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102162 CVSSv3.1 Base Score: 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSSv4.0 Base Score: 9.4...

A memory buffer overflow vulnerability exists in an internal diagnostic routine of Brocade Fabric OS (CVE-2026-94582)

: A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First FSPF protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directl...

Stack-based Buffer Overflow in REST API device management component of Brocade Fabric OS

: Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads—such as device configuration attributes or port mapping requests—the REST API service fails to properly validate...

Heap-Based Buffer Overflow in Port List Parsing within Brocade Fabric OS

: When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can...

AlmaLinux 9.6 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1791296305)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791296305 advisory. - A flaw was found in GIMP's PSP Paint Shop Pro file parser. A remote attacker could exploit an integer overflow vulnerability in th...

CVE-2026-106378: Execution with Unnecessary Privileges

Privilege elevation in Sandbox in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-107200

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager affected versions not specified Description A missing integrity verification issue in the client agent software allows an unauthenticated remote attacker to introduce untrusted code. This could lead to t...

PT-2026-107148

Name of the Vulnerable Software and Affected Versions Arista Wi-Fi access points affected versions not specified Description A stack overflow exists in the wireless gateway service of Arista Wi-Fi access points when a captive portal or application firewall is enabled on at least one SSID. An...

PT-2026-107254

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper neutralization of special elements used in an OS command allows a remote, unauthenticated attacker to execute arbitrary code. Approximately 18.8k instances have been identifie...

Apache Curator 5.9.0 Java Deserialization

Apache Curator version 5.9.0 contains an unsafe Jackson deserialization issue in its service-discovery component that can instantiate an attacker-controlled payload class. !/usr/bin/env python Apache Curator 5.9.0 Java Deserialization Vendor: The Apache Software Foundation Product web page:...

CVE-2026-86360: Improper Limitation of a Pathname to a Restricted Directory

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This...