VulnCheck KEV: CVE-2026-58231

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...

CVE-2026-14669

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-16239

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

Linux Distros Unpatched Vulnerability : CVE-2026-73625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options...

PT-2026-72080

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account...

PT-2026-72059

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction...

PT-2026-72079

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

Linux Distros Unpatched Vulnerability : CVE-2026-63298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrar...

IBM Informix Dynamic Server 12.10.x / 14.10.x < 14.10.xC13W13 / 15.0.x < 15.0.1.13 RCE (7282827)

The version of IBM Informix Dynamic Server installed on the remote host is 12.10.x, or 14.10.x prior to 14.10.xC13W13, or 15.0.x prior to 15.0.1.13. It is, therefore, affected by a remote code execution vulnerability in the IBM Informix Wire Listener as referenced in the 7282827 vendor advisory. ...

Security Updates for Microsoft Dynamics 365 (on-premises) (August 2026)

The Microsoft Dynamics 365 on-premises is missing security updates. It is,therefore, affected by the following vulnerabilities: - Deserialization of untrusted data in Microsoft Dynamics 365 on-premises allows an authorized attacker to execute code over a network. CVE-2026-65815 - Exposure of...

Siemens Solid Edge SE2025 < V225.0 Update 15 / SE2026 < V226.0 Update 7 Multiple Vulnerabilities (SSA-621657)

The version of Siemens Solid Edge installed on the remote Windows host is SE2025 prior to V225.0 Update 15, or SE2026 prior to V226.0 Update 7. It is, therefore, affected by multiple file parsing vulnerabilities: - The affected applications contains an out of bounds read vulnerability while parsi...

PT-2026-71974

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the upload files capability This issue affects all versions of WordPress...

Microsoft PowerShell 7.4.x < 7.4.19 / 7.5.x < 7.5.10 / 7.6.x < 7.6.5 Multiple Vulnerabilities (August 2026)

The version of Microsoft PowerShell installed on the remote host is 7.4.x prior to 7.4.19, 7.5.x prior to 7.5.10, or 7.6.x prior to 7.6.5. It is, therefore, affected by multiple vulnerabilities: - Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code...

Security update for himmelblau (important)

openSUSE security update: security update for himmelblau ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21573-1 Rating: important References: bsc1270946 bsc1270985 bsc1273910 bsc1273911 bsc1273912 Cross-References: CVE-2026-45784 CVSS scores:...

CVE-2026-14671

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a C...

Debian dla-4740 : libecpg-compat3 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4740 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4740-1 [email protected]...

org.apache.sshd/sshd-core: Apache MINA SSHD: Unauthorized command execution due to improper certificate validation

A flaw was found in Apache MINA SSHD server-side. During user authentication, the server's OpenSSH user certificate validation process failed to properly check for or validate unsupported options like 'force-command' or 'verify-required' embedded within a user's certificate. This oversight could...

CVE-2026-73231

A flaw was found in Faker, a library for generating fake data. The faker.helpers.fake method allows an attacker to control fake templates, which can then access the Function constructor. This access, specifically through fakeEval.resolveProperty when a function returns another function, enables...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...