Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

Ubuntu 18.04 LTS / 24.04 LTS : dracut vulnerabilities (USN-8828-1)

The remote Ubuntu 18.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8828-1 advisory. It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could...

The vulnerability of the firmware update mode of microprogramming devices with Reyrolle 7SR5 protection and automation systems allows a intruder to execute arbitrary code or cause a service failure.

The vulnerability of the firmware update mode of Reyrolle 7SR5 devices for relay protection and automation systems lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause malfunctions in the device’s...

The vulnerability of the microprogramming software of Reyrolle 7SR5 devices, related to the loading of code without checking its integrity, allows a perpetrator to execute arbitrary code.

The vulnerability of the microprogramming software in relay protection and automation devices from Reyrolle 7SR5 relates to the loading of code without checking its integrity. Exploiting this vulnerability can allow an intruder to execute arbitrary code...

The vulnerability of the ToolPane.GetPartPreviewAndPropertiesFromMarkup() function in Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, and Microsoft SharePoint Server Subscription Edition packages allows a attacker to execute arbitrary code.

The vulnerability of the ToolPane.GetPartPreviewAndPropertiesFromMarkup function in Microsoft SharePoint Server, Microsoft SharePoint Enterprise Server, and Microsoft SharePoint Server Subscription Edition packages is related to improper code generation. Exploiting this vulnerability could allow ...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to buffer overflows in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

The vulnerability of the USB Mass Storage Class Driver for Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the USB Mass Storage Class Driver for Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

SUSE CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...

SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-98025

A flaw was found in the Linux kernel's cx82310eth USB Ethernet driver. An attacker connecting a malicious USB device can trigger a heap-based buffer overflow by sending crafted packets containing a reboot indicator. Because the driver fails to discard the packet after detecting the reboot signal,...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...

EUVD-2024-55773

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

[SECURITY] [DSA 6527-1] rsync security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6527-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 28, 2026 https://www.debian.org/security/faq -...

CVE-2026-98016

A flaw was found in the Linux kernel's Mellanox network driver mlx5e. A race condition occurs during the concurrent teardown of traffic control TC sample rules sharing the same context, causing the system to reference memory after it has already been freed. A local user with network administrativ...

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have...

CVE-2026-12717

A flaw was found in BigQuery Data Transfer Service. An authenticated attacker can achieve arbitrary code execution within the connector container by supplying crafted Java Database Connectivity JDBC connection string parameters. Successful exploitation can further allow the attacker to escalate...

USN-8840-1: libevent vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. CVE-2026-63387 It was discovered that libevent incorrectly handled certain...

Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks

Apple has released security updates to address a vulnerability in older versions of iOS, iPadOS, and macOS that it said may have been exploited in targeted attacks. The vulnerability, tracked as CVE-2026-86950 , refers to an out-of-bounds write impacting the CoreGraphics component that could lead...

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have...