RHEL 6 : vim (RHSA-2026:69128)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69128 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary code execution via OS command...

EulerOS Virtualization 2.10.0 : libxml2 (EulerOS-SA-2026-3874)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershe...

ALSA-2026:69099 Important: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

CVE-2026-61852: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-65651: Uncontrolled Recursion

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses...

CVE-2026-89139: Improper Neutralization of Special Elements used in an OS Command

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...

VulnCheck KEV: CVE-2026-88062

OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before...

CVE-2026-77521: Improper Neutralization of Special Elements used in an OS Command

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupton, so human approval is not required...

ROS-20260921-73-0116

The vulnerability of the NewKeyring function in the Go programming language is related to improper storage of permissions. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

The vulnerability of the golang-x-image package, a programming language, allows attackers to trigger a service failure.

The vulnerability of the golang-x-image package, a programming language, is related to unlimited resource distribution. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

EulerOS Virtualization 2.10.1 : libxml2 (EulerOS-SA-2026-3840)

According to the versions of the libxml2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershe...

EulerOS Virtualization 2.10.1 : shim (EulerOS-SA-2026-3855)

According to the versions of the shim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may...

Linux Distros Unpatched Vulnerability : CVE-2026-54634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld sendraw command on TCP port 4532 reaches...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

CVE-2026-94588: Improper Neutralization of Argument Delimiters in a Command

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in...

RHEL 9 : redis:7 (RHSA-2026:69521)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69521 advisory. Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, set...

Releasing Spring for Modern Challenges

Releasing Spring For Modern Challenges TL;DR: The Spring release train has been updated from a two week long train to a single day, the Thursday after the third Monday of the month. The next regular patch train will be on October 22nd. A milestone only train will occur on September 24th. Back in...

Security update for coredns (important)

openSUSE Security Update: Security update for coredns Announcement ID: openSUSE-SU-2026:0324-1 Rating: important References: 1276712 Cross-References: CVE-2026-27140 CVE-2026-27143 CVE-2026-27144 CVE-2026-32282 CVE-2026-32283 CVE-2026-32288 CVE-2026-32289 CVE-2026-32934 CVE-2026-32936...

Security update for cadvisor (important)

openSUSE Security Update: Security update for cadvisor Announcement ID: openSUSE-SU-2026:0340-1 Rating: important References: 1279044 1279224 1279320 Cross-References: CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 CVSS scores: CVE-2026-84303 SUSE: 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N...

CVE-2026-88410: Undefined Security Weakness

The graph.UDF in FalkorDB Redis module v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application...