AlmaLinux 8 : tesseract (ALSA-2026:95725)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:95725 advisory. tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data CVE-2026-88048 tesseract: Tesseract: Stack buffer...

CVE-2026-104657: Progress Software Fiddler Download & Setup Skill: Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows…

Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows which allows an attacker to compromise or influence a release component and execute attacker-controlled code when a user runs the skill. On macOS, the skill stages the package at ...

CVE-2026-123325: JetBrains YouTrack: In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible…

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sandbox page...

CVE-2026-123293: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting...

CVE-2026-123838: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file...

CVE-2026-123279: JetBrains Datalore: In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators...

UBUNTU-CVE-2026-121997

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to writ...

CVE-2026-123675: OpenBMB Internet of Agents: A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a

A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function executecode of the file imclient/agents/tools/codeexecutor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. T...

CVE-2026-123302: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery...

CVE-2026-123308: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects...

CVE-2026-123831: JetBrains CLion: In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings...

RHEL 9 : tesseract (RHSA-2026:95086)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95086 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNL...

HPESBVS05168 rev.1 - HPE VM Essentials Software, Multiple Vulnerabilities

Potential Security Impact: Remote: Code Execution, Multiple Vulnerabilities SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Morpheus Software - VM Essentials HPE VME 9.0 9.0.2 HPE Morpheus Software HPE VME 9.0 9.0.2 - N/A HPE Morpheus Software - Advanced HPE VME 9.0 9.0.2 - N/...

CVE-2026-123280: JetBrains Datalore: In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports...

CVE-2026-121994

A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetchregisterusingp, which decodes a stub's register reply into an alloca-sized buffer without bounding writes b...

CVE-2026-123151

A flaw was found in the GNU debugger GDB. When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with...

CVE-2026-123276: JetBrains CLion: In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug…

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile...

CVE-2026-123853: JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM…

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process...

UBUNTU-CVE-2026-123151

A flaw was found in the GNU debugger GDB. When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with...

CVE-2026-90436: Apache Software Foundation Apache Axis 1.x (EOL): ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated…

UNSUPPORTED WHEN ASSIGNED Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated remote class instantiation. When a SOAP carries a element, Axis loads the named class and, if a String element is also present, instantiates it through its String constructor before checki...