APSB26-155 : Security updates available for Substance 3D Modeler

Adobe has released an update for Adobe Substance 3D Modeler. This update addresses critical vulnerabilities that could result in arbitrary code execution. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates...

PT-2026-96774

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 6.2.0 Description The CPython bytecode .pyc marshal parser in radare2 contains a flaw where marshal readers accept a 32-bit string length without validating if the value overflows the size-plus-one allocation. When...

RHEL 8 : postgresql:15 (RHSA-2026:69923)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69923 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

RockyLinux 8 : libtiff (RLSA-2026:69095)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:69095 advisory. libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 Tenable has extracted the preceding description block directly from the...

RHEL 9 : postgresql:15 (RHSA-2026:69698)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69698 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2026-091364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091364 advisory. Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can result in arbitrary code execution. This attack appear to be...

AlmaLinux 9 : gstreamer1-plugins-base (ALSA-2026:69100)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:69100 advisory. gstreamer: GStreamer: Arbitrary code execution via OGG file parsing buffer overflow CVE-2026-18297 gstreamer1-plugins-base: gstreamer: NULL/invalid-point...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-reportlab (UTSA-2023-002178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002178 advisory. Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Tenable has extracted the preceding description block directly...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: firefox (UTSA-2026-090053)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090053 advisory. When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and...

RockyLinux 8 : postgresql:16 (RLSA-2026:69876)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69876 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...

Adobe Substance 3D Modeler 1.0.0 < 1.22.8 Multiple Arbitrary code execution (APSB26-155)

The version of Adobe Substance 3D Modeler installed on the remote host is prior to 1.22.8. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-155 advisory. - Substance3D - Modeler is affected by an out-of-bounds write vulnerability that could result in arbitrary co...

PT-2026-97076

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description An adjacent-network attacker could execute arbitrary code due to the deserialization of untrusted data. Deserialization is the process of...

PT-2026-96786

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description MISP registers the PHP phar stream wrapper in its web and console entry points. This wrapper causes PHP to treat phar archives as directories, leading to two security risks: any filesystem...

NotepadPlusPlus: CVE-2026-85279: Stack-based Buffer Overflow

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount result controls a loop that writes to...

CVE-2026-81995: Improper Input Validation

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue do...

CVE-2026-96269: Inclusion of Functionality from Untrusted Control Sphere

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...

PT-2026-96830

Name of the Vulnerable Software and Affected Versions glibc versions 2.14 through 2.44 Description A time-of-check to time-of-use TOCTOU race condition exists in the dynamic loader ld.so. This occurs when expanding $ORIGIN in DT RPATH for setuid/setgid AT SECURE programs; the system validates the...

CVE-2026-82008: Improper Input Validation

Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require...

APSB26-148 : Security Updates Available for Adobe Bridge

Adobe has released a security update for Adobe Bridge. This update addresses critical and important vulnerabilities that could result in arbitrary code execution and memory exposure. Adobe is not aware of any exploits in the wild for any of the issues addressed in this update...

Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY...