mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

mariadb: Arbitrary Code Execution via improper parameter validation during State Snapshot Transfer

A flaw was found in MariaDB. During a State Snapshot Transfer SST, the donor node improperly validates parameters sent by a joiner node. This vulnerability allows a malicious joiner to execute arbitrary shell commands on the donor server through the mariabackup SST method. This could lead to a...

mariadb: Arbitrary code execution via global system variable manipulation by a high-privileged user

A flaw was found in MariaDB server. A high-privileged MariaDB user could exploit this vulnerability by manipulating specific global system variables, namely wsrepsstreceiveaddress or wsrepsstdonor. This manipulation could allow the user to execute arbitrary shell commands as the user ID of the...

Important: Red Hat Security Advisory: galera and mariadb11.8 security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-11979

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...

libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations,...

PT-2026-53902

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and 2023.20 and earlier Description Improper input validation allows for arbitrary code execution in the context of the current user. This issue can be exploited without requiring any user interaction. Recommendation...

PT-2026-54161

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description An integer overflow in the Chromecast component allows a local attacker to execute arbitrary code by sending malicious network traffic. Recommendations Update Google Chrome to version...

PT-2026-53904

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2025.9 and earlier Description An unrestricted upload of files with dangerous types allows for arbitrary code execution in the context of the current user. This issue can be exploited without requiring any user...

PT-2026-53948

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Users with access to Redis can execute arbitrary code with full application privileges. This allows for the compromise of all secrets, data, and system integrity. Recommendations At th...

Multiple Mozilla products have buffer overflow vulnerabilities (CNVD-2026-26886)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Mozilla Firefox ESR is an extended support version of Firefox the web browser developed by the Mozilla Foundation. Mozilla Thunderbird is an email client software independently developed from t...

Hitachi Energy e-mesh EMS

SUMMARY Hitachi Energy is aware of a buffer overflow vulnerability that affects e-mesh EMS product versions listed in this document. Successful exploitation of this vulnerability could lead to a buffer overflow condition, potentially resulting in application outages denial of service and...

KLA91123 Multiple vulnerability in Mozilla Firefox

Multiple vulnerability was found in Mozilla Firefox. Malicious users can exploit this vulnerability to cause denial of service, execute arbitrary code. Original advisories MFSA2026-62 Exploitation Related products Mozilla-Firefox CVE list CVE-2026-14241 critical Solution Update to the latest...

Security update for ansible-core (important)

openSUSE security update: security update for ansible-core ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21097-1 Rating: important References: bsc1267822 Cross-References: CVE-2026-11332 CVSS scores: CVE-2026-11332 SUSE : 7.8...

PT-2026-54379

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description Insufficient validation of untrusted input in WebAppInstalls allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Recommendations Update Google...

PT-2026-54005

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description The software fails to detect the built-in trace.Trace.run function during the analysis of pickle files. This allows remote attackers to embed malicious code within the reduce method of a crafted...

Dell Peripheral Manager permissions and access control vulnerabilities (CNVD-2026-26537)

Dell Peripheral Manager is a peripheral device management software developed by the American company Dell. Versions of Dell Peripheral Manager prior to 1.7.3 contained security vulnerabilities. Attackers could exploit these vulnerabilities to execute arbitrary code by preloading malicious DLLs...

PT-2026-53947

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Improper validation of flow nodes that have missing or empty component type fields can lead to arbitrary code execution. Arbitrary code execution occurs when an attacker can run...

PT-2026-53906

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic versions prior to 7.4.3 build 9396 Description An incorrect authorization issue exists that allows for arbitrary code execution in the context of the current user. This flaw does not require user interaction to be...

AlmaLinux 10 : perl-IO-Compress (ALSA-2026:30860)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:30860 advisory. perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob CVE-2026-48962 Tenable has extracted the preceding description...