CVE-2026-43642: Deserialization of Untrusted Data

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that allows unauthenticated remote attackers to supply arbitrary serialized PHP objects for deserialization by setting the act parameter to login with the...

ALSA-2026:69876 Important: postgresql:16 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

CVE-2026-24267: Deserialization of Untrusted Data

NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information...

CVE-2026-95508: Out-of-bounds Write

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...

CVE-2026-65179: Deserialization of Untrusted Data

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

Adobe Substance 3D Modeler 1.0.0 < 1.22.8 Multiple Arbitrary code execution (APSB26-155)

The version of Adobe Substance 3D Modeler installed on the remote host is prior to 1.22.8. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-155 advisory. - Substance3D - Modeler is affected by a Stack-based Buffer Overflow vulnerability that could result in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2026-091364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091364 advisory. Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can result in arbitrary code execution. This attack appear to be...

AlmaLinux 8 : freerdp (ALSA-2026:69387)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:69387 advisory. FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway CVE-2026-55193 Tenable has extracted the preceding description block directly fro...

RHEL 8 : postgresql:15 (RHSA-2026:69923)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69923 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: vim (UTSA-2022-000573)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000573 advisory. Buffer Over-read in function findnextquote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: haproxy (UTSA-2026-090137)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090137 advisory. In hpackdhtinsert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location ...

ROS-20260922-73-0109

The vulnerability in the 389-ds-base is related to a numerical overflow issue. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

ROS-20260922-73-0111

The vulnerability in the 389-ds-base is related to errors in data type mixing. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260922-73-0006

The vulnerability in gstreamer1-plugins-good is related to a potential integer overflow. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

RockyLinux 8 : postgresql:15 (RLSA-2026:69923)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69923 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...

RockyLinux 10 : openssh (RLSA-2026:69129)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69129 advisory. openssh: OpenSSH: sftp client allows attacker to control downloaded file location CVE-2026-59995 openssh: OpenSSH sshd: Security bypass due to incorrec...

ROS-20260922-73-0001

The vulnerability in gstreamer1-plugins-good is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260922-73-0112

The vulnerability in the 389-ds-base is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-96269: Inclusion of Functionality from Untrusted Control Sphere

GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it...