SUSE CVE-2026-87817

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that...

Malicious code in @nexustechpro/baileys (npm)

Source: amazon-inspector fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab @nexustechpro/baileys is a fork of the WhatsApp library baileys in which lib/Socket/chats.js 270 KB is heavily obfuscated obfuscator.io-style rotating string-array decoder, hex-escaped import specifiers such...

RLSA-2026:65887 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: Incomplete fix for...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...

CVE-2026-84889: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

CVE-2026-82097: Server-Side Request Forgery (SSRF)

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to a Server-Side Request Forgery SSRF vulnerability...

CVE-2026-63427: Authentication Bypass by Spoofing

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges...

CVE-2026-68006: Inconsistent Interpretation of HTTP Requests

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/pumahttp11/http11parser.rl file...

CVE-2026-81046: Improper Access Control

Dell ThinOS 10, versions prior to 260510.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context...

CVE-2026-81049: Missing Support for Integrity Check

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-81052: Download of Code Without Integrity Check

Dell ThinOS 10, versions prior to 260510.2616, contain a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-42805: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI C library within the debug message parser function bhi385parsedebugmessage located in bhi385parse.c. The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlle...

CVE-2026-42804: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPIC-Library in versions up to and including commit d6b200416a. The vulnerability is located within the FIFO parsing and debug logging subsystem inside the function bhi360parsedebugmessage in bhi360parse.c line...

CVE-2026-13745: Inclusion of Functionality from Untrusted Control Sphere

A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINICLIHOME to load malicious configuration...

PT-2026-89490

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri url launcher.dart, OpenFilex.open, localPathRegex common patterns.dart components...

CVE-2026-81940: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...

CVE-2026-15419: Stack-based Buffer Overflow

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges...

PT-2026-89640

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A Server-Side Request Forgery SSRF issue allows a remote authenticated attacker to execute arbitrary code. SSRF is a flaw where an attacker can induce the server-side application ...

PT-2026-89510

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges...

Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : libssh2 vulnerabilities (USN-8722-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8722-1 advisory. It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an S...