RockyLinux 9 : valkey (RLSA-2026:64807)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:64807 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in...

ROS-20260909-73-0156

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause service interruptions using a specially created font file...

The vulnerability of the ovpn_tcp_close() function in the drivers/net/ovpn/tcp.c module of the Linux kernel’s network device driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ovpntcpclose function in the drivers/net/ovpn/tcp.c module of the Linux kernel’s network device driver is related to a race condition in the signal processing routine. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

ROS-20260909-73-0074

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Palo Alto Networks PAN-OS 10.2.x / 11.1.x / 11.2.x / 12.1.x / 12.2.x Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is a vulnerable version of 10.2.x, 11.1.x, 11.2.x, 12.1.x, or 12.2.x. It is, therefore, affected by a vulnerability. A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enable...

SAP NetWeaver Memory Corruption (3747649)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3747649: - A memory safety vulnerability exists in the Extended Passport Protocol EPP processing library. Under specific conditions, an...

ROS-20260909-73-0174

The vulnerability of the Skia component in the Google Chrome web browser is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the _get_outline() function in the pypdf/_doc_common.py library of the Python library for working with PDF files, PyPDF, allows a attacker to cause a service failure.

The vulnerability of the getoutline function in the pypdf/doccommon.py library of the Python PDF handling library PyPDF is related to asymmetric resource consumption. Exploiting this vulnerability could allow an attacker to cause a service failure...

AlmaLinux 9 : valkey (ALSA-2026:64807)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64807 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in stre...

CVE-2026-86420

A flaw was found in ImageMagick. This vulnerability occurs when the software fails to correctly manage its memory budget during certain image processing operations. Repeatedly triggering these failures can lead to the exhaustion of the process's memory, causing the application to become...

CVE-2026-85458

A flaw was found in Xpdf. This vulnerability, a divide-by-zero error, occurs when the application processes a Type 3 font glyph that has a zero height. A local attacker could exploit this condition to trigger a crash, leading to a denial of service and making the application unavailable. Mitigati...

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Impact A number of vulnerabilities, two rated as "Critical" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution RCE on glibc-based Linux when run under certain conditions. The attack vector for these claims to ...

Security Bulletin: IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

Summary IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-16190 DESCRIPTION: IBM WebSphere Application Server is affected by an authorization bypass vulnerability. CWE:CWE-862: Missing Authorization CVSS...

GHSA-C7Q8-3CH8-VQPV xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...

EUVD-2026-69239

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed...

EUVD-2026-69216

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions...

GHSA-G53G-W8RJ-FMG7 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Summary @xmldom/xmldom's processing-instruction PI grammar regex exhibits quadratic-time backtracking ReDoS when parsing an unterminated processing instruction. A single small XML document containing forces the regular expression engine into On² work, stalling the Node.js event loop. The input is...

gpsd: gpsd: Arbitrary OS command execution via code injection in gpsprof utility

A flaw was found in gpsd. This code injection vulnerability in the gpsprof utility allows an attacker to execute arbitrary operating system OS commands. By controlling GPS input data, an attacker can inject malicious content into the SKY.satellites.used field. This unsanitized input is then...