AlmaLinux 9 : postgresql:15 (ALSA-2026:69914)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69914 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrar...

SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4309-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4309-1 advisory. Security issues fixed: - CVE-2026-59088: denial of service via signed integer overflow in FLI file processing...

D-Link DAP-1360 Code Execution

The vulnerability of the web interface for managing microprogrammed wireless access points from D-Link DAP-1360 is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted...

LibreNMS Shell Exec RCE

The vulnerability of the shellexec function in the LibreNMS network monitoring system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

D-Link DIR-825 Router Code Execution

The vulnerability of the tunnelsetparams function in the rp-l2tp component of D-Link’s DIR-825 router software lies in the fact that the operation of writing data beyond the buffer in memory occurs when processing the peerhostname parameter. Exploiting this vulnerability allows a remote attacker ...

Linux Distros Unpatched Vulnerability : CVE-2026-81878

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's CPython bytecode .pyc marshal parser was vulnerable...

Important: libxml2 security update

The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks...

CVE-2026-95519: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-89078

GitLab CE/EE versions 19.2 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a double free vulnerability. This issue occurs when the system parses a specially crafted regular expression within a CI/CD configuration , which could allow an authenticated user to execute arb...

CVE-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-93577 Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free UAF condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hciconn pointers, potentially...

gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...

gitpython: GitPython: Command Injection via Git option prefix abbreviation

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous...

Malicious code in pino-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7 [email protected] impersonates the widely-used pino logger: package.json declares the name pino-testkit with pino's description, lists Matteo Colli...

MAL-2026-16484 Malicious code in pino-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2711bf14b5de8acc2d8a401de585d09de28c4dc674331f6578acbc9ea36c6e7 [email protected] impersonates the widely-used pino logger: package.json declares the name pino-testkit with pino's description, lists Matteo Colli...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.6.0 Vulnerability Details CVEID:CVE-2026-59278 DESCRIPTION: JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include...

CVE-2026-81537

IBM DataStage on Cloud Pak for Data 5.4.0.0 is susceptible to an OS command injection vulnerability. This flaw could allow a remote authenticated attacker to execute arbitrary code on the target system. No specific exploit information or remediation steps are provided in the documents, though the...

CVE-2026-81537 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection...