kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

A flaw was found in the Linux kernel's Bluetooth management component. This vulnerability involves a Use-After-Free UAF condition, a type of memory corruption where the system attempts to use memory after it has been freed. This can occur due to improper handling of hciconn pointers, potentially...

MAL-2026-16470 Malicious code in z-deno-truth-bwhlsz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db0813755b79e157c644502848b1ff5af003fc82fb842b39676490d00f33e814 The package's exports field maps the ./package.json subpath to setup.js, so any consumer resolving require'z-deno-truth-bwhlsz/package.json' executes...

kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...

EUVD-2026-84957

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-84966

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to execute arbitrary code due to improper validation of a specified quantity...

EUVD-2026-84965

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

SUSE CVE-2026-93088

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages direct...

GitLab 19.2 < 19.2.7 / 19.3 < 19.3.3 / 19.4 < 19.4.1 (CVE-2026-89078)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an...

EUVD-2026-85403

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-91795: Untrusted Pointer Dereference

Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-91727

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process...

Linux Distros Unpatched Vulnerability : CVE-2026-91735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execu...

CVE-2026-86926: Heap-based Buffer Overflow

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3...

PDF Memory Use Code Execution

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat, Adobe Acrobat Reader, and Adobe Acrobat 2024 relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code, provided that the user open...

CVE-2026-91801: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-86938: Authorization Bypass Through User-Controlled Key

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3...

VeloCloud Orchestrator Code Execution

The vulnerability of the locally deployed version of the orchestrator VeloCloud Orchestrator VCO on the VMware SD-WAN by VeloCloud On-Prem platform is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute...

RHEL 9 : postgresql:16 (RHSA-2026:70856)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70856 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...