CVE-2026-87723: Untrusted Search Path

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

RHEL 9 : rrdtool (RHSA-2026:72278)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:72278 advisory. The round robin database RRD system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load...

RHEL 9 : rrdtool (RHSA-2026:72277)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:72277 advisory. The round robin database RRD system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load...

PT-2026-99764

Name of the Vulnerable Software and Affected Versions Google fuse-archive versions prior to 1.24 Description An attacker can hijack the execution pathway by prepending a directory to the PATH environment variable or by writing a malicious binary to a writable directory that appears in the PATH...

CVE-2026-97875 DNS rebinding vulnerability in rojo serve HTTP API

Rojo's "rojo serve" HTTP API default port 34872 has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open with no user interaction beyond visiting...

libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...

rrdtool: rrdtool: Stack buffer overflow allows local code execution or denial of service

A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary...

Moderate: Red Hat Security Advisory: rrdtool security update

An update for rrdtool is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHEL 9 : rrdtool (RHSA-2026:71600)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:71600 advisory. The round robin database RRD system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load...

CVE-2026-6935: Uncontrolled Search Path Element

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code...

PT-2026-97593

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description The software invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. This allows an attacker with local system access to...

PT-2026-97586

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Improper bounds checking leads to a buffer overflow, which occurs when a program writes more data to a block of memory than it can hold. A local user can exploit this to execute arbitrary co...

PT-2026-97590

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Incorrect memory management leads to a double free issue, which occurs when the program attempts to free the same memory location twice. A local attacker can exploit this to corrupt heap...

CVE-2026-89281

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution...

EUVD-2026-84682

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget (specifically Windows builds from eternallybored.org ). The root cause is a hardcoded configuration file path at C:\msys64 which is writable by unprivileged users. This allows an attacker to achieve arbitrary code execution via th...

CVE-2026-89281 CVE-2026-89281

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution...

EUVD-2026-84681

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution...

CVE-2026-89281 CVE-2026-89281

The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf path that can allow local code execution...

CVE-2026-89281

The Apache Lounge Windows distribution of Apache HTTP Server build is affected by a hardcoded configuration path vulnerability specifically within the openssl.cnf path. This security flaw can lead to local code execution . No specific remediation, exploit links, or versions are provided in the do...