EUVD-2026-62910

In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...

EUVD-2026-63126

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fshmanage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all relevant data and affect system integrity and...

EUVD-2026-63120

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all...

EUVD-2026-63121

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...

Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

MAL-2026-14336 Malicious code in arrayref (crates.io)

arrayref 0.3.10 was published to crates.io from a maintainer account droundy that appears to be compromised. Unlike every prior release, 0.3.10 declares a dependency on the malicious crate proc-macro1. The arrayref source itself is unchanged genuine macro code, but Cargo compiles the declared...

PT-2026-79129

Use after free in DOM in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-79178

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

MAL-2026-14338 Malicious code in proc_macro1 (crates.io)

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...

PT-2026-79130

Buffer overflow in Network in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

The vulnerability of the psql utility in the PostgreSQL database management system allows a hacker to execute arbitrary commands.

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-231-01)

The version of mozilla-firefox installed on the remote host is prior to 140.14.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-231-01 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

PT-2026-79088

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

JetBrains IntelliJ IDEA < 2026.2.1 Multiple Vulnerabilities

The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains IntelliJ IDEA before 2026.2.1 RCE via Markdown export tool was possible. CVE-2026-75056 - In JetBrains IntelliJ IDEA before 2026.2.1 SSR...

Dell Wyse Management Suite < 2605.0.2 Multiple Vulnerabilities (DSA-2026-329)

The version of Dell Wyse Management Suite installed on the remote host is prior to 2605.0.2. It is, therefore, affected by multiple vulnerabilities, including: - Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A...

PT-2026-79224

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...

PT-2026-79234

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow...

PT-2026-79199

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

Malicious code in tinymember (crates.io)

tinymember is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...