CVE-2026-112944 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...

CVE-2026-112177

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177

A flaw exists in Ghostscript as shipped with Red Hat Enterprise Linux 8 due to the omission of a previous security correction during a version rebase from 9.25 to 9.27. Specifically, privileged .forceput operations in the .charkeys procedure are insufficiently protected. Processing a specially cr...

CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177 Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

CVE-2026-112177

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

Oracle Weblogic Server - Remote Command Execution

Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. id: CVE-2020-14882 info: name: Oracle Weblogic Server - Remote Command Execution author: dwisiswant0 severity:...

CVE-2026-77934

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

EUVD-2026-104690

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

CVE-2026-77934

Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow code nodes in an unsandboxed python3 subprocess. Attackers can bypass the regex import filter with import'subprocess' to run commands, stealing environment...

Fedora 46 : dolphin (2026-77dc014196)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-77dc014196 advisory. Automatic update for dolphin-26.08.2-2.fc46. Changelog Fri Oct 16 2026 Than Ngo - 26.08.2-2 - Fix rhbz2553643 - CVE-2026-110236 dolphin: dolphin: Arbitrary...

CentOS 9 : vim-8.2.2637-42.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the vim-8.2.2637-42.el9 build changelog. - Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a...

PT-2026-118259

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

ProSoft RLX-IFH24E version 2.2.44 Unsigned Upgrade Package Root Command Execution

ProSoft RLX-IFH24E version 2.2.44 firmware upgrades do not verify package authenticity, allowing an authenticated attacker to upload a crafted package that executes commands as root on the appliance. https://packetstorm.news/download/236509...

Exasol Database 7.1.30 Default Credential Python UDF Command Execution

Exasol Database version 7.1.30 docker-db deployments use the documented SYS default credential, which can create a PYTHON3 UDF invoking os.popen and return command output through SELECT. https://packetstorm.news/download/236507...

PT-2026-118405

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description The launchEditor function forwards file paths to editors without proper sanitization. If an attacker can create a filesystem entry starting with a plus + or minus - sign in the working...

PT-2026-118599

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...

PT-2026-118631

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.7 Description The bash activate script fails to properly escape the environment name during the two passes bash performs over the PS1 prompt variable. Consequently, a backslash in the environment name can und...