17813 matches found
NewStart CGSL MAIN 6.06 : ghostscript Multiple Vulnerabilities (NS-SA-2026-0055)
The remote NewStart CGSL host, running version MAIN 6.06, has ghostscript packages installed that are affected by multiple vulnerabilities: - A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This...
CVE-2026-14958 OS command injection in IBM Aspera Faspex
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...
CVE-2026-50738
A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a...
SUSE CVE-2026-66040
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
MAL-2026-11132 Malicious code in bianira-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...
MAL-2026-11142 Malicious code in node-array-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ce58719e0587902be3a6436f329ce631317fe3a7c322d89f9c679cd6e1a744 index.js is heavily obfuscated with a 312-entry rotated string array plus RC4/base64 decoders that hide identifiers and literals. On require, the...
CVE-2026-21047
CVE-2026-21047 involves an out-of-bounds write in the ImsService, before SMR Jul-2026 Release 1. This condition could enable remote code execution. The impact is described as potentially arbitrary code execution by a remote attacker, with network access required and no user interaction. The remed...
SUSE-SU-2026:3339-1 Security update for apache-sshd
This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the sshd-scp component of Apache MINA SSHD. bsc1272158...
CVE-2026-11756
Technical details for CVE-2026-11756 are not publicly available in the provided documents. No specifics on affected product versions, vectors, or mitigations are provided. Monitor for updates from the sources.
CVE-2026-11756 Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution...
PT-2026-65579
Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 Description Remote code execution and path-segment injection are possible when the collectiveController-1.0 feature is enabled. Path-segment injection occurs when an...
CVE-2026-51275
...
Veeder-Root TLS4B Command Injection (CVE-2025-58428)
The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...
CVE-2026-64696
This vulnerability affects macOS Sequoia 15.7.8 , macOS Sonoma 14.8.8 , and macOS Tahoe 26.6 . The root cause is improper memory handling , which could allow a remote user to cause unexpected system termination or corrupt kernel memory . To remediate this issue, users should update to the affecte...
CVE-2026-43810
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A remote user may be able to cause unexpected system...
CVE-2026-63077
CVE-2026-63077 affects JetBrains TeamCity On-Premises: unauthenticated remote code execution via deserialization of untrusted data in the agent polling protocol. Affected are TeamCity versions prior to 2025.11.7 and prior to 2026.1.3. The root cause is deserialization of untrusted data that allow...
CVE-2026-51304
...
VulnCheck KEV: CVE-2026-58138
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
MiracleLinux 9 : valkey-8.0.9-1.el9_8 (AXSA:2026-1342:03)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1342:03 advisory. redis: use-after-free in unblock client flow may allow remote code execution CVE-2026-23479 redis: Remote code execution via use-after-free in Lua...
