vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

Chromium: CVE-2026-17967 Use after free in Chrome for iOS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

OPENSUSE-SU-2026:21506-1 Security update for spice-vdagent

This update for spice-vdagent fixes the following issues: - CVE-2026-57965: integer overflow in udscswrite allows a compromised SPICE host to crash the spice-vdagent daemon via a specially crafted message that triggers a heap buffer overflow bsc1269553. - CVE-2026-57966: improper sanitization...

GHSA-7RG2-8XRH-RWH8 vulnerabilities

Vulnerabilities for packages: firefox...

SUSE CVE-2026-17711

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-66280)

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the...

Important Photon OS Security Update - PHSA-2026-4.0-1059

Updates of 'openssh' packages of Photon OS have been released...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66279)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero NULL Pointer Dereference (CVE-2026-24716)

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

The vulnerability of the zynqmp_efuse_access() function in the drivers/nvmem/zynqmp_nvmem.c file of the NVMEM device driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the zynqmpefuseaccess function in the drivers/nvmem/zynqmpnvmem.c file of the NVMEM device driver in the Linux operating system is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Qnap QTS and QuTS hero OS Command Injection (CVE-2026-22893)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

The vulnerability of the Python library for working with Git Dulwich repositories lies in the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows attackers to execute arbitrary commands.

The vulnerability of the Python library for working with Git repositories in Dulwich is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Qnap QTS and QuTS hero OS Command Injection (CVE-2025-66273)

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS...

Qnap QTS and QuTS hero Stack-based Buffer Overflow (CVE-2025-62858)

A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions:...

Important Photon OS Security Update - PHSA-2026-5.0-0936

Updates of 'openssh' packages of Photon OS have been released...

SUSE CVE-2026-17841

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-26191

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root macOS/Linux or SYSTEM Windows on managed endpoints when an uninstall is triggered. When a...

SUSE CVE-2026-44477

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE...