PT-2026-96248

Name of the Vulnerable Software and Affected Versions Joplin Desktop for Windows versions prior to 3.7.2 Description Joplin Desktop for Windows fails to include the publisherName in the packages/app-desktop/package.json file. This omission causes the NsisUpdater.verifySignature function to skip t...

PT-2026-96096

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

ROS-20260921-73-0016

The vulnerability of the printing subsystem in Samba networking-enabled programs is related to the lack of measures taken to neutralize special elements during the processing of the %J parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-88404

A remote code execution RCE vulnerability in the UniscriptExecutionService.execute function /services/script-execution.service.ts of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code...

Tesseract OCR GenericVector read code execution

The vulnerability of the GenericVector::read function in the src/ccutil/genericvector.h file of the Tesseract OCR system is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2026-88405

The Univer v1.0.0-alpha.2 software is vulnerable to a remote code execution (RCE) flaw within the RemoteRegisterFunctionService function, specifically located at /remote/remote-register-function.service.ts. An attacker can exploit this vulnerability by sending a crafted payload to execute arbitra...

CVE-2026-79079: Improper Neutralization of Special Elements used in an OS Command

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

CVE-2026-79079

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

ROS-20260921-73-0086

The vulnerability involves loading unreliable external data alongside reliable data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium CVE-2026-19173...

SUSE SLED15 / SLES15 Security Update : emacs (SUSE-SU-2026:4083-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4083-1 advisory. - Arbitrary code execution when opening a specially crafted file bsc1275941. - CVE-2026-77219: integer overflo...

RHEL 9 : osbuild-composer (RHSA-2026:69293)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69293 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

PT-2026-96304

Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...

RHEL 10 : kernel (RHSA-2026:69089)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69089 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: RDMA/mana: Remove user...

OPENSUSE-SU-2026:21883-1 Security update for freeipmi

This update for freeipmi fixes the following issues: - CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses bsc1278719. - CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem bsc1278722. - CVE-2026-85506: Arbitrary code execution via...

PT-2026-95915

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to correctly validate file extensions when extracting files from an uploaded archive. This occurs because a variable is reused as a...

PT-2026-95974

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L version 2.01b05 Description A stack-based buffer overflow exists in the Authentication Handler component within the /webfa authentication.cgi endpoint. The issue occurs when the strcpy function processes the id and password...