PT-2026-71485

Heap buffer overflow in PostgreSQL pg dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

PT-2026-71926

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

PT-2026-71918

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

Linux Distros Unpatched Vulnerability : CVE-2026-6464

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If th...

Vim < 9.2.0840 Arbitrary Code Execution (GHSA-rcr7-f3wr-22r2)

The version of Vim installed on the remote host is prior to 9.2.0840. It is, therefore, affected by a vulnerability as referenced in the GHSA-rcr7-f3wr-22r2 advisory. - runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and...

Linux Distros Unpatched Vulnerability : CVE-2026-15742

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system use...

Linux Distros Unpatched Vulnerability : CVE-2026-16238

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

Linux Distros Unpatched Vulnerability : CVE-2026-16239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in PostgreSQL portal/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation ...

Linux Distros Unpatched Vulnerability : CVE-2026-14680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion with PostgreSQL internal data type arguments allows any user to execute arbitrary code as the operating system user running the database, via cal...

Security Updates for Microsoft Word Products C2R (August 2026)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. CVE-2026-58651, CVE-2026-64915 - Stack-based buffer overflow in Microsof...

Linux Distros Unpatched Vulnerability : CVE-2026-53783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-19385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user runni...

Linux Distros Unpatched Vulnerability : CVE-2026-48553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the...

Vulnerability in contrib module (CVE-2026-15742)

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL...

Vulnerability in core server (CVE-2026-14680)

PostgreSQL type confusion via "internal" arguments Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of...

Vulnerability in core server (CVE-2026-14662)

PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may...

Vulnerability in core server (CVE-2026-14670)

PostgreSQL plperl tied object heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL...

Vulnerability in core server (CVE-2026-14664)

PostgreSQL regexp heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006,...

Vulnerability in core server (CVE-2026-6471)

PostgreSQL logical decoding can dlopen arbitrary file Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn ru...