ROS-20261002-73-0017

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-104197

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”...

PT-2026-104196

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

PT-2026-104159

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

PT-2026-104161

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

PT-2026-104189

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

PT-2026-104192

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomMotivo” parameter is affected – endpoint “/es/lostmotives/store”...

PT-2026-104170

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomZonaGeo” parameter is affected – endpoint “/es/geozones/update/149979”...

PT-2026-104171

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTransportista” parameter is affected – endpoint “/es/carriers/update”...

PT-2026-104183

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

PT-2026-104174

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTipoCli” parameter is affected – endpoint “/es/clientypes/update/109441”...

ROS-20261002-73-0148

The vulnerability of the contact search component in the SOGo collaborative work software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code or gain unauthorized access to protected information...

Red Hat: CVE-2026-94422: xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

CVE-2026-103631: Heap-based Buffer Overflow

Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-103630: Use After Free

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-104411

Name of the Vulnerable Software and Affected Versions Apache OpenOffice versions prior to 4.1.17 Description A code execution issue exists in the Java integration of the software. A crafted untrusted document can trigger the execution of arbitrary code, including remote code, when opened by a use...

SUSE SLES16: emacs / emacs-el / emacs-eln / emacs-info / emacs-nox / emacs-x11 / etc (SUSE-SU-2026:23949-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:23949-1 advisory. This update for emacs fixes the following issue: - CVE-2026-96442: arbitrary code execution when viewing or editing untrusted text files in...

Fedora 45 : 0ad / GAPDoc / GConf2 / GraphicsMagick / ImageMagick / Io-language / etc (2026-91259c13b9)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-91259c13b9 advisory. libxml2 updated to version 2.15.4, compat libxml22.13 added, and rebuilds of packages linking to libxml2. Packages that FTBFS will require the compa...

openSUSE 16: emacs / emacs-el / emacs-eln / emacs-games / emacs-info / emacs-nox / etc (openSUSE-SU-2026:21974-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21974-1 advisory. This update for emacs fixes the following issue: - CVE-2026-96442: arbitrary code execution when viewing or editing untrusted text files in modes other...

The vulnerability of the ColdFusion software platform, related to the failure to eliminate instructions in dynamically executed code, allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...