PT-2026-96096

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The blocklist workflow module fails to validate the file extension of a user-supplied filename parameter. While the basename function is used to remove path components and checks are performed for empt...

PT-2026-96642

Name of the Vulnerable Software and Affected Versions Ghostscript affected versions not specified Description Ghostscript incorrectly handles JPEG 2000 image components that have mismatched subsampling factors. An attacker could cause the application to crash or execute arbitrary code by inducing...

CVE-2026-88405

The Univer v1.0.0-alpha.2 software is vulnerable to a remote code execution (RCE) flaw within the RemoteRegisterFunctionService function, specifically located at /remote/remote-register-function.service.ts. An attacker can exploit this vulnerability by sending a crafted payload to execute arbitra...

ROS-20260921-73-0086

The vulnerability involves loading unreliable external data alongside reliable data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

SUSE SLES15: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (SUSE-SU-2026:4017-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4017-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

SUSE SLED15: postgresql17 / postgresql17-contrib / postgresql17-devel / etc (SUSE-SU-2026:4016-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4016-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. -...

TencentOS Server 3: gstreamer1-plugins-bad-free (TSSA-2026:1028)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1028 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

ALSA-2026:69095 Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...

Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...

SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:4015-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4015-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

Failover Cluster Code Execution

The vulnerability of the Failover Cluster component for Windows operating systems is related to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

PT-2026-96248

Name of the Vulnerable Software and Affected Versions Joplin Desktop for Windows versions prior to 3.7.2 Description Joplin Desktop for Windows fails to include the publisherName in the packages/app-desktop/package.json file. This omission causes the NsisUpdater.verifySignature function to skip t...

PT-2026-96304

Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...

CVE-2026-78847

An issue in gray-matter All versions verified on 4.0.3 allows the JavaScript engine in lib/engines.js using eval to parse front matter when language is js/javascript.This allows arbitrary code execution...

CVE-2026-79079

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

ALSA-2026:69607 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

RHEL 9 : osbuild-composer (RHSA-2026:69293)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69293 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

RHEL 10 : kernel (RHSA-2026:69089)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69089 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/mana: Remove user...

CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

PT-2026-96124

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description An unrestricted file upload issue exists in the core/modules/media.php file. Remote authenticated users with access to the Media Manager panel can upload files of dangerous types to execute arbitrary code...