CVE-2026-81867: Deserialization of Untrusted Data

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared production servers using a specially...

Citrix NetScaler ADC and Gateway DTLS Vulnerability Scanner

Citrix NetScaler ADC and NetScaler Gateway versions before 14.1-73.37 and 13.1-64.23 contain a DTLS memory overflow vulnerability that may lead to remote code execution or denial of service. This tool fingerprints exposed services, assesses build versions, and optionally sends a DTLS probe...

macOS 26.x < 26.7.1 (149228)

The remote host is running a version of macOS / Mac OS X that is 26.x prior to 26.7.1. It is, therefore, affected by a vulnerability: - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe...

MiracleLinux 8 : libxml2-2.9.7-21.el8_10.9 (AXSA:2026-1925:10)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1925:10 advisory. libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86138 libxml2: libxml2: Data integrity issues due to integer...

RHEL 9 : postgresql (RHSA-2026:72281)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72281 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

MiracleLinux 9 : unbound-1.24.2-3.el9_8.8 (AXSA:2026-1924:15)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1924:15 advisory. unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis CVE-2026-82717 unbound: Unbound: Heap buffer overflow via malicious DNSSEC...

The vulnerability of NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) access control systems, related to insufficient input data validation, allows attackers to execute arbitrary commands.

The vulnerability of NetScaler ADC formerly Citrix ADC and the NetScaler Gateway access control system formerly Citrix Gateway is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20260928-73-0071

The vulnerability of the procreaddirde function in the Linux operating system is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause a service failure...

CVE-2026-101894: Improper Limitation of a Pathname to a Restricted Directory

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-12342: Improper Input Validation

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

PT-2026-99805

Name of the Vulnerable Software and Affected Versions Wireshark versions prior to 4.6.9 Description Multiple issues exist across protocol dissectors, capture-file parsers, the Sharkd utility, and configuration-profile handling, affecting protocols such as ZigBee, SCTP, IEEE 802.11, USB HID, and...

PT-2026-99931

Name of the Vulnerable Software and Affected Versions kube-compare affected versions not specified Description A flaw exists when processing a container:// reference path, where the tool incorrectly executes the entrypoint of an untrusted container image instead of extracting data from a stopped...

Important: webkitgtk4

Issue Overview: Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High CVE-2026-85049 Affected Packages: webkitgtk4 Note: This advisory is applicable to Amazon...

PT-2026-99849

Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description An issue exists that allows PowerShell command injection during the Windows DNS SPF/TXT record push process, which can lead to remote code execution. Recommendations Update ManageEngi...

CVE-2026-54708: Improper Limitation of a Pathname to a Restricted Directory

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or writ...

CVE-2026-12268: Improper Input Validation

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...

CVE-2026-86334: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

RockyLinux 8 : postgresql:12 (RLSA-2026:72274)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72274 advisory. postgresql: PostgreSQL code execution in restore operation CVE-2025-8714 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion i...

RHEL 10 : ipa (RHSA-2026:72279)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:72279 advisory. Red Hat Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and...

RHEL 9 : rrdtool (RHSA-2026:72278)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:72278 advisory. The round robin database RRD system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load...