kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation

A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

kernel: ipv6: fix possible UAF in icmpv6_rcv()

A flaw was found in the Linux kernel's IPv6 Internet Protocol version 6 implementation. This vulnerability, a Use-After-Free UAF error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

EUVD-2026-80049

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

EUVD-2026-80033

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntoolstcpdumpstartset.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code...

SUSE CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

CVE-2026-85469: Reliance on Insufficiently Trustworthy Component

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-73456: Improper Control of Generation of Code

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface gNPSI enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised...

CVE-2026-63325: Improper Control of Generation of Code

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-92128: Download of Code Without Integrity Check

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...

CVE-2026-92127: Improper Control of Generation of Code

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier automatically approves the classpath entries in an item configuration when a user with Overall/Administer permission copies the item, or updates that configuration through the REST API or CLI, allowing attackers able to define classpat...

CVE-2026-73166: Improper Control of Generation of Code

Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary code on the device, including OS...

CVE-2026-73453: Improper Control of Generation of Code

An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...

PT-2026-93866

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker with at least low-privileged administrative credentials to execute arbitrary commands on the underlyin...

PT-2026-93771

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin downloads a JAR file from a specified URL twice. It confirms the approval of the first download but loads the classpath entries from the second. This...

PT-2026-94124

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description djust allows an unauthenticated WebSocket or SSE client to trigger the import and execution of the top-level code of any importable Python module. This occurs because the live transport resolves the...

PT-2026-93911

Name of the Vulnerable Software and Affected Versions @redocly/respect-core versions prior to 2.33.0 @redocly/cli versions prior to 2.33.0 Description The respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

PT-2026-93765

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions 1415.v9a f9b 3a c253d and earlier Description An issue exists where the plugin fails to verify the method called through a proxy created when a sandboxed script coerces a value to an interface. If the...