PT-2026-97845

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary code due to unsafe deserialization of untrusted data. Deserialization is the process of converting a data stream back into an...

PT-2026-98270

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code...

Versal Adaptive SoC – Secure Boot Bypass via Board Modifications and Crafted Boot Image

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0482| In AMD Versal™ Adaptive SoC devices, insufficient boundary checks within the USB boot mode—when enabled via board modifications—allow crafted images to overflow a buffer and...

Versal Adaptive SoC – Secure Boot Bypass via Board Modifications and Crafted Boot Image

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-0482| In AMD Versal™ Adaptive SoC devices, insufficient boundary checks within the USB boot mode—when enabled via board modifications—allow crafted images to overflow a buffer and...

PT-2026-97839

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary code due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

PT-2026-105045

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-93291: Improper Certificate Validation

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code...

CVE-2026-97230: Embedded Malicious Code

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base6...

CVE-2026-95519: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-11744: Improper Neutralization of Input During Web Page Generation

An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to t...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8810-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8810-1 advisory. It was discovered that ImageMagick did not correctly handle certain memory...

CVE-2026-89078: Double Free

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

RHEL 9 : freerdp (RHSA-2026:71390)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71390 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

PT-2026-97798

Name of the Vulnerable Software and Affected Versions rpm affected versions not specified Description A flaw exists where the software processes crafted manifest files during operations such as rpm -q -p or similar manifest-processing flows. The issue occurs because manifest entries undergo...

PT-2026-98258

Name of the Vulnerable Software and Affected Versions AWS pgcollection versions 2.0.0 through 2.1.1 Description A type confusion issue exists in this PostgreSQL extension. An authenticated remote user can execute arbitrary code as the postgres operating system user by using crafted SQL statements...

CVE-2026-81539: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

CVE-2026-89325: Uncontrolled Search Path Element

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check...

MiracleLinux 8 : postgresql:16 (AXSA:2026-1909:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1909:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

RockyLinux 8 : postgresql:12 (RLSA-2026:69924)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69924 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql:...

RHEL 9 : freerdp (RHSA-2026:71388)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71388 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...