CVE-2026-14670

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected...

ALPINE-CVE-2026-14664

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

CVE-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a C...

CVE-2026-16238

Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before...

CVE-2026-14680

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for...

EUVD-2026-57836

Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

Linux Distros Unpatched Vulnerability : CVE-2026-14671

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in PostgreSQL module refint allows an object creator to execute arbitrary code as the operating system user running the database. The fix for thi...

PT-2026-71467

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A heap buffer overflow occurs in the to chartimestamptz...

ROOT-OS-ALPINE-323-CVE-2026-9545 CVE-2026-9545 in curl - Patched by Root

Root has patched CVE-2026-9545 in the curl package for Root:Alpine:3.23. Multiple fixed versions available...

CVE-2026-13206 Multiple Vulnerabilities in Zyxel's WAH7601 - OS Command Injection

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72579

An OS command injection vulnerability in NASA HyperCP main branch allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation...

EUVD-2026-55233

An OS command injection vulnerability in 4xmen/pm2panel all versions allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec'pm2 restart ' + id without input...

CVE-2026-72573

CVE-2026-72573 describes an authenticated OS command injection in 4xmen/pm2panel (all versions). The vulnerability arises because the pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id), without input validation or shell escaping, en...

Astra Linux – Vulnerability in PostgresSQL-15

Lack of validation for multibyte character lengths in PostgreSQL text manipulation allows a database user to execute crafted queries that lead to a buffer overflow. This enables the execution of arbitrary code as the operating system user running the database. Versions prior to PostgreSQL 18.2,...

Astra Linux – Vulnerability in PostgresSQL-15

Lack of type validation for input in the PostgreSQL intarray extension’s selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...

ROOT-OS-ALPINE-317-CVE-2026-28390 CVE-2026-28390 in openssl - Patched by Root

Root has patched CVE-2026-28390 in the openssl package for Root:Alpine:3.17. Multiple fixed versions available...

Update of els-os-release

Initial package...

EulerOS 2.0 SP11 : samba (EulerOS-SA-2026-3156)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the 'chec...

Linux Distros Unpatched Vulnerability : CVE-2026-65819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets befo...