CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

PT-2026-93911

Name of the Vulnerable Software and Affected Versions @redocly/respect-core versions prior to 2.33.0 @redocly/cli versions prior to 2.33.0 Description The respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

PT-2026-93866

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker with at least low-privileged administrative credentials to execute arbitrary commands on the underlyin...

CVE-2026-63325: Improper Control of Generation of Code

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : polkit vulnerability (USN-8762-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8762-1 advisory. It was discovered that polkit incorrectly handled cookie input. A local attacker could...

SUSE SLED15 / SLES15 Security Update : python-GitPython (SUSE-SU-2026:4191-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4191-1 advisory. - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the...

Oracle Linux 8 : ELSA-2026-67278-0: / perl:5.32 (ELSA-2026-672780)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672780 advisory. - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Fix CVE-2025-40909 - Clone dirhandles without fchdir - Fix CVE-2023-47038 - Fix...

Debian dsa-6501 : firefox-esr - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6501 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6501-1 [email protected] https://www.debian.org/securit...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

PT-2026-93864

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the diagnostic tools allows an authenticated remote attacker with administrative credentials to perform command injection on the...

PT-2026-93765

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...

Google Chrome Authorization Vulnerability (CNVD-2026-37839)

Google Chrome is a free web browser developed by Google Inc. Google Chrome has a permission-related vulnerability, which stems from improper permissions in DevTools. Attackers can exploit this vulnerability to execute arbitrary code outside the sandbox through specially crafted HTML pages...

PT-2026-93367

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On platforms where the gRPC Network Management Interface gNMI is enabled, an authenticated client with gNMI access can send a specially crafted request to execute arbitrary code with root...

PT-2026-93411

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution on platforms running Arista EOS when P4Runtime is...

ALSA-2026:67910 Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library. Security Fixes: libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63387...

PT-2026-93771

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin downloads a JAR file from a specified URL twice. It confirms the approval of the first download but loads the classpath entries from the second. This...

Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

SUSE CVE-2026-90947

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

SUSE CVE-2026-90948

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer overflow can occur during the calculation of the required buffer size. This leads to an undersized buffer being allocated, causing a heap-based buffer overflow when the decoded pix...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ci parameter in the GET request, which is passed to the unserialize function without restricting allowed classes. An attacker can execute arbitrary code or manipulate the database by supplying a...