The vulnerability of the automation tool for configuring and building projects based on BitBake lies in the improper verification of the SSH key, allowing an attacker to execute a “man-in-the-middle” attack.

The vulnerability of the automation tool for configuring and building projects based on BitBake is related to incorrect verification of the SSH key. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middle” attack...

AlmaLinux 10 : postgresql16 (ALSA-2026:70186)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70186 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...

AlmaLinux 9 : postgresql (ALSA-2026:69607)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69607 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrar...

TencentOS Server 4: libvirt (TSSA-2026:1048)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-94106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft...

Oracle Linux 8 : coreutils (ELSA-2026-69964)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-69964 advisory. 8.30-21.0.1 - clean up empty file if cp is failed Orabug 15973168 - df --local: recognize afs, auristorfs, and smb3 as remote fs 1798030 - fix formatting of...

RHEL 9 : postgresql:16 (RHSA-2026:70559)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70559 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

RHEL 9 : postgresql:15 (RHSA-2026:70763)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70763 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

RHEL 10 : libxml2 (RHSA-2026:70596)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70596 advisory. The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fixes: libxml2: Stack Buffer Overflow ...

TencentOS Server 4: storm (TSSA-2026:1037)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1037 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : OpenSSH vulnerabilities (USN-8804-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8804-1 advisory. Florian Kohnhuser discovered that OpenSSH incorrectly handled shell metacharacters in certain usernames. An attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-83603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in...

CVE-2026-80412: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation...

Penpot 2.17.2 Arbitrary File Overwrite

Penpot versions 1.20 through 2.17.2 contain a missing authorization vulnerability in the file import RPC command. An authenticated attacker can supply the identifier of another user's file to overwrite its contents and re-parent the file into an attacker-controlled project, resulting in file...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection SSTI. The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to an...

CVE-2026-82369: Improper Neutralization of Special Elements used in an OS Command

Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell...

CVE-2026-84683: Improper Neutralization of Input During Web Page Generation

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-95593: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Ultimeter = 3.0.8 versions...

CVE-2026-71465: Improper Neutralization of Argument Delimiters in a Command

RunAdHocCommand.buildargs appends limit as bare positional args.appendlimit instead of using args.extend'-l', limit like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags --version, --help since injected element displaces required patter...