EUVD-2026-85121

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-91801

Foxit PDF Editor/Reader is susceptible to a path traversal vulnerability within its handling of embedded PDF resources , specifically involving RichMedia Annotations . The vulnerability is caused by insufficient validation of resource file paths , which may allow files to be written outside of th...

CVE-2026-91812 Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...

EUVD-2026-85162

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...

CVE-2026-91812 Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges...

CVE-2026-91813 Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...

CVE-2026-91813 Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...

EUVD-2026-85161

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges...

CVE-2026-91813

A vulnerability in the Foxit PDF Editor/Reader update mechanism (specifically FoxitUpdater ) allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation . This race condition could enable local attackers to execu...

EUVD-2026-85160

Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution...

CVE-2026-91815

Foxit PDF Editor/Reader is vulnerable to CVE-2026-91815 due to insufficient verification of JPEG2000 image metadata within PDF files. This flaw leads to an out-of-bounds write in the heap buffer during decoding, which can result in a program crash or the risk of arbitrary code execution . No spec...

CVE-2026-50228 Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

CVE-2026-50228

An unauthenticated local attacker can exploit a vulnerability in Acer NitroSense software (versions up to and including 5.2.63 ) by connecting to an exposed Electron DevTools endpoint on localhost TCP port 9993 . The root cause is that Chromium remote debugging remains enabled in the production a...

CVE-2026-50228 Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...