ROS-20260922-73-0131

The vulnerability of the lzmaindexAppend function in the XZ Utils data compression package is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260922-73-0011

The vulnerability in gstreamer1-plugins-bad-free is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260922-73-0009

The vulnerability in gstreamer1-plugins-bad-free is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260922-73-0106

The vulnerability in the 389-ds-base is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20260922-73-0021

The vulnerability in log4j is related to a lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

ROS-20260922-73-0024

The vulnerability in gstreamer1-plugins-bad-free is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ntfs-3g (UTSA-2022-000915)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000915 advisory. A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the...

CVE-2026-65128: Improper Neutralization of Special Elements used in an SQL Command

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-65125: External Control of File Name or Path

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service...

CVE-2026-57149: Improper Neutralization of Directives in Dynamically Evaluated Code

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...

CVE-2026-28325: Deserialization of Untrusted Data

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode...

CVE-2026-89275: Improper Control of Generation of Code

Adobe Campaign Classic ACC is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue...

CVE-2026-65130: Improper Neutralization of Special Elements used in an OS Command

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2025-1281: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax and uxcbtoolsexportajax functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with...

CVE-2026-94574: Undefined Security Weakness

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-65178: Deserialization of Untrusted Data

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted modelconfig.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2023-000318)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000318 advisory. Git is distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to g...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2023-002313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002313 advisory. Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499. Tenable has extracted the preceding description block directly from the Unity Linu...

CVE-2026-91827: Deserialization of Untrusted Data

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

RHEL 9 : redis (RHSA-2026:69862)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69862 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...