SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:4015-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4015-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

SUSE SLED15: postgresql17 / postgresql17-contrib / postgresql17-devel / etc (SUSE-SU-2026:4016-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4016-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. -...

Failover Cluster Code Execution

The vulnerability of the Failover Cluster component for Windows operating systems is related to the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium CVE-2026-19173...

Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

Important: libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format TIFF files. Security Fixes: libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 For more details about the security issues, including the impact, a CVSS score,...

CVE-2026-79079

An issue in CrossWire Xiphos = 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menupopup.c components...

ROS-20260921-73-0086

The vulnerability involves loading unreliable external data alongside reliable data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

PT-2026-96096

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

CVE-2026-94383: Unrestricted Upload of File with Dangerous Type

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...

RHEL 9 : osbuild-composer (RHSA-2026:69293)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69293 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

PT-2026-96304

Name of the Vulnerable Software and Affected Versions gray-matter affected versions not specified Description An issue in the JavaScript engine located in lib/engines.js uses the eval function to parse front matter when the language is set to js/javascript, which can lead to arbitrary code...

SUSE SLES15: postgresql17 / postgresql17-contrib / postgresql17-devel / etc (SUSE-SU-2026:4013-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4013-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

OPENSUSE-SU-2026:21883-1 Security update for freeipmi

This update for freeipmi fixes the following issues: - CVE-2026-85504: stack-based buffer overflow via malformed Fujitsu SEL long-text responses bsc1278719. - CVE-2026-85505: Denial of Service via stack-based buffer over-read in ipmi-oem bsc1278722. - CVE-2026-85506: Arbitrary code execution via...

PT-2026-95915

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to correctly validate file extensions when extracting files from an uploaded archive. This occurs because a variable is reused as a...

PT-2026-95974

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L version 2.01b05 Description A stack-based buffer overflow exists in the Authentication Handler component within the /webfa authentication.cgi endpoint. The issue occurs when the strcpy function processes the id and password...

CVE-2026-87067: Improper Control of Generation of Code

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-81650: Unrestricted Upload of File with Dangerous Type

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability...