Security update for python-GitPython

This update for python-GitPython fixes the following issues: CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...

SUSE-SU-2026:4191-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...

RLSA-2026:67314 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...

postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein or levenshteinlessequal SQL functions. This allows the user to execute arbitrary code as the operating system user running th...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists

A flaw was found in PostgreSQL pgdump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

CVE-2026-91778

CVE-2026-91778 affects Octopus Server and stems from incorrect permission validation during script execution. Users holding certain scoped permission sets can execute arbitrary scripts on a worker—including the Octopus Server built-in worker—without possessing the required authorization. This is ...

CVE-2026-101911

creationtimestamp| type| source ---|---|--- 2026-09-15 04:15:03+00:00| published-proof-of-concept| https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw 2026-09-30 05:30:30+00:00| seen| https://gist.github.com/alon710/8432dbe3939654e0587f7004c91b9879 2026-09-30...

CVE-2026-88618

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...

RockyLinux 10 : nginx (RLSA-2026:67314)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLin...

RHEL 9 : postgresql:16 (RHSA-2026:67491)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67491 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

PT-2026-92170

An issue in MitraStar GPT-2742GX4X5v6-SV GL g2.5 100XNT0b23 3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...