EulerOS 2.0 SP15 : vim (EulerOS-SA-2026-3824)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave in...

RHEL 7 : vim (RHSA-2026:68711)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68711 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: arbitrary command execution via modeline sandbox...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

PT-2026-94134

Name of the Vulnerable Software and Affected Versions Affinity by Canva versions prior to 3.3.0 Description Insufficient bounds checking during the parsing of Affinity document files leads to a stack-based buffer overflow. This occurs when the application processes a specially crafted document,...

PT-2026-95060

Name of the Vulnerable Software and Affected Versions lxc-ci Arch Linux images published prior to 2026-05-28 Description Images built from images/archlinux.yaml contain a shared pacman local-signing private key located in /etc/pacman.d/gnupg, which is redistributed to all containers or virtual...

PT-2026-94191

Name of the Vulnerable Software and Affected Versions flatpak-builder affected versions not specified Description A flaw exists where Git hooks are not disabled when applying patch sources with use-git-am set to true. An attacker providing a malicious source containing a Git post-applypatch hook...

CVE-2026-92950: Insecure Default Variable Initialization

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses requirefilename to re-execute itself in the host realm, bypassing sandbox...

CVE-2026-90823: Stack-based Buffer Overflow

FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/authuserpass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that...

CVE-2026-92838: Uncontrolled Search Path Element

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If...

CVE-2026-81546: Stack-based Buffer Overflow

The Affinity by Canva application before 3.3.0 September 2026 release did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in...

Flatpak-Builder code injection vulnerability

Flatpak-Builder has a code injection vulnerability. This vulnerability arises from the fact that when using the use-git-am:true parameter to specify the patch source, Git hooks are not disabled. This allows attackers to execute arbitrary code with the privileges of the user running Flatpak-Builde...

CVE-2026-19477: Stack-based Buffer Overflow

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux uldaq. This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux uldaq v1.2.1 and prior versions...

CVE-2026-93375: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

PT-2026-95059

Name of the Vulnerable Software and Affected Versions MCC Universal Library for Linux uldaq versions prior to 1.2.1 Description A stack-based buffer overflow exists in the library, which can lead to arbitrary code execution or information disclosure. A stack-based buffer overflow occurs when a...

PT-2026-94740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists when reading bpf link information. In the functions bpf link show fdinfo and bpf link get info by fd, the link-prog variable is accessed without proper...

RockyLinux 9 : libevent (RLSA-2026:67910)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67910 advisory. libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63383 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of...

AlmaLinux 9 : postgresql:18 (ALSA-2026:67848)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67848 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

AlmaLinux 10 : postgresql18 (ALSA-2026:67280)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67280 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

Deserialization of Untrusted Data

Overview kedro-datasets is a Kedro-Datasets is where you can find all of Kedro's data connectors. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the PyTorchDataset process. An attacker can execute arbitrary code by supplying a malicious .pt model file fro...