Checkov Code Analysis Code Execution

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2026-2147)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2147 advisory. GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions an...

Linux Distros Unpatched Vulnerability : CVE-2026-90949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a...

Mirasvit Full Page Cache Warmer Extension Code Execution

The vulnerability of the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce lies in the shortcomings of its deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.12.20260914 or dnf...

PT-2026-98208

Vulnerabilities were discovered in the Info-ZIP unzip program, which could result in the execution of arbitrary code if a specially crafted file is processed...

PT-2026-91259

Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw in the Lighting Effects filter occurs when processing a specially crafted lighting preset file. The filter fails to properly validate the number of light sources, leading to an...

CVE-2026-82770: Buffer Copy without Checking Size of Input

Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed...

CVE-2026-84506: Use After Free

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to execute arbitrary code with kernel privileges...

CVE-2026-84568: Improper Limitation of a Pathname to a Restricted Directory

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

PT-2026-91835

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...

RockyLinux 8 : nginx:1.24 (RLSA-2026:67315)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67315 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLinu...

MiracleLinux 9 : perl-DBI-1.643-9.el9_8.5 (AXSA:2026-1822:04)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1822:04 advisory. DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-19546 Tenable has extracted the precedi...

RHEL 10 : nginx (RHSA-2026:67314)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67314 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:4095-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4095-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...

RockyLinux 9 : nginx:1.24 (RLSA-2026:67308)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67308 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLinu...

RHEL 9 : ansible-core (RHSA-2026:67466)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67466 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH...

Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2026-2156)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2156 advisory. An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Tenable has extracted th...

ROS-20260914-73-0046

The vulnerability in Chromium is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-82789: Improper Neutralization of Directives in Dynamically Evaluated Code

An improper neutralization of directives in dynamically evaluated code 'Eval Injection' issue exists in CONPROSYS HMI SystemCHS. If exploited, arbitrary code may be executed by an attacker who can log in to the product...