Alibaba Cloud Linux 3 : 0256: mingw-glib2 (ALINUX3-SA-2026:0256)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0256 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-14087: A flaw was found in GLib...

Linux Distros Unpatched Vulnerability : CVE-2026-16239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in PostgreSQL portal/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation ...

Linux Distros Unpatched Vulnerability : CVE-2026-53783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated...

Vim < 9.2.0840 Arbitrary Code Execution (GHSA-rcr7-f3wr-22r2)

The version of Vim installed on the remote host is prior to 9.2.0840. It is, therefore, affected by a vulnerability as referenced in the GHSA-rcr7-f3wr-22r2 advisory. - runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and...

Linux Distros Unpatched Vulnerability : CVE-2026-14670

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the...

PT-2026-71467

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the to chartimestamptz...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

ROS-20260813-73-0003

The vulnerability in podman is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Vulnerability in core server (CVE-2026-16239)

PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions...

Vulnerability in contrib module (CVE-2026-15742)

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL...

Vulnerability in core server (CVE-2026-6471)

PostgreSQL logical decoding can dlopen arbitrary file Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn ru...

Vulnerability in core server (CVE-2026-14662)

PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may...

Vulnerability in core server (CVE-2026-14680)

PostgreSQL type confusion via "internal" arguments Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of...

Vulnerability in core server (CVE-2026-14664)

PostgreSQL regexp heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006,...

Vulnerability in core server (CVE-2026-14670)

PostgreSQL plperl tied object heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL...

PT-2026-71842

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper authentication may allow a remote attacker to execute arbitrary code or obtain sensitive information. Recommendations At the moment, there is no information about a newer version that contain...

PT-2026-71705

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0 Description The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token JWT secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the...

Linux Distros Unpatched Vulnerability : CVE-2026-48553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the...

PT-2026-71904

luci-app-openvpn fails to properly validate the instance name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing S...

PT-2026-71883

FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration in Music.class.php. An authenticated administrator can use options that write files, ope...