PT-2026-71479

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description An integer wraparound in the fuzzystrmatch module allows ...

PT-2026-71469

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion in the "refint" module allows an object...

PT-2026-71484

Untrusted data inclusion in pg dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql restrict meta-command input expansion. The fix for CVE-2025-871...

PT-2026-71468

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the plperl language...

PT-2026-71464

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

PT-2026-71476

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion involving the internal data type arguments...

PT-2026-71481

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A type confusion issue exists in the portal and cursor...

ROS-20260813-73-0005

The vulnerability in Gitea is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PostgreSQL -- Multiple vulnerabilities

The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before data rows begin, processes the following data lines as psql commands. CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns ownership of dependent extended statistics objects to the current user...

UBUNTU-CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

Debian dsa-6436 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6436 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6436-1 [email protected] https://www.debian.org/securit...

PT-2026-71888

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4

CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4. A patched version of the package is available...

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26

CVE-2026-38752 affecting package busybox for versions less than 1.36.1-26. A patched version of the package is available...

CVE-2026-11856 affecting package curl for versions less than 8.11.1-11

CVE-2026-11856 affecting package curl for versions less than 8.11.1-11. A patched version of the package is available...

CVE-2026-14647 affecting package pytorch for versions less than 2.2.2-16

CVE-2026-14647 affecting package pytorch for versions less than 2.2.2-16. A patched version of the package is available...

CVE-2026-49481

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the...

CVE-2026-49819

UpSnap (wake on LAN web app) versions 4.4.1–5.3.5 are vulnerable to an unauthenticated privilege-escalation chain in pb.HandlerInitSuperuser (backend/pb/handlers.go:249). The vulnerability is reachable via POST /api/upsnap/init-superuser and is gated only by a totalSuperusers > 0 check, with n...

CVE-2026-49819 UpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...

CVE-2026-49819

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in pb.HandlerInitSuperuser backend/pb/handlers.go:249, reachable as POST /api/upsnap/init-superuser. The vulnerable code lacks any authentication, setup token, IP...