ROS-20260813-73-0055

The vulnerability in perl-XML-Parser is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-14676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via...

Malicious code in bs58-15 (npm)

npm/bs58-15 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-15x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency declar...

Vulnerability in core server (CVE-2026-14669)

PostgreSQL tochar heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQ...

Vulnerability in core server (CVE-2026-16238)

PostgreSQL type confusion in pgrestoreattributestats executes arbitrary code Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major versi...

Vulnerability in client (CVE-2026-18408)

PostgreSQL psql \unrestrict lets superuser of pgdump origin server execute arbitrary code in psql client Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account...

Vulnerability in contrib module (CVE-2026-14671)

PostgreSQL refint plan cache type confusion executes arbitrary code Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the g...

CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4

CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4. A patched version of the package is available...

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...

CVE-2026-11856 affecting package curl for versions less than 8.11.1-11

CVE-2026-11856 affecting package curl for versions less than 8.11.1-11. A patched version of the package is available...

CVE-2026-14647 affecting package pytorch for versions less than 2.2.2-16

CVE-2026-14647 affecting package pytorch for versions less than 2.2.2-16. A patched version of the package is available...

CVE-2026-49481

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...

CVE-2026-49819

UpSnap (wake on LAN web app) versions 4.4.1–5.3.5 are vulnerable to an unauthenticated privilege-escalation chain in pb.HandlerInitSuperuser (backend/pb/handlers.go:249). The vulnerability is reachable via POST /api/upsnap/init-superuser and is gated only by a totalSuperusers > 0 check, with n...

CVE-2026-49819

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...

CVE-2026-49819 UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...

EUVD-2026-57697

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...

CVE-2026-49819 UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...

CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-49481 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...

CVE-2026-49481 UpSnap vulnerable to Remote Code Execution via IP Field Template Injection in wake_cmd/shutdown_cmd

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...