EUVD-2026-63365

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76635: Improper Neutralization of Special Elements used in an SQL Command

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

Fedora 44 : firefox (2026-fc11919789)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc11919789 advisory. Implement buffer stride support for PipeWire camera. ---- - Update to latest upstream 154.0 - Enabled Wayland session restore on KDE. Tenable has...

CVE-2026-64971: Improper Neutralization of Input During Web Page Generation

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

PT-2026-79019

ATutor is vulnerable to Reflected XSS in restore functionality. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported and the vulnerabilities have not been fixed. Only version...

PT-2026-80731

Name of the Vulnerable Software and Affected Versions Velero versions prior to 1.18.1 Description An attacker who gains control of the backup object-storage backend can upload a malicious backup tarball. This tarball can contain parent-directory paths that allow files to escape the intended...

PT-2026-79023

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

CVE-2026-76614

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...

CVE-2026-76614

OpenEMR versions before 8.3.0 contain a path traversal vulnerability in the EDI archive restore function. The archrestore_sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the files...

CVE-2026-76614 OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...

CVE-2026-76614 OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestoresel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, an...

CVE-2026-74311

A flaw was found in the Linux kernel. During a system restore operation, the virtio real-time clock RTC component fails to properly manage virtual queues virtqueues. If the reinitialization of these virtqueues fails, the system attempts to delete queues using incorrect memory references. This can...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3639-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3639-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3638-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3638-1 advisory. This update for redis fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

SUSE SLES15 Security Update : redis (SUSE-SU-2026:3637-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3637-1 advisory. This update for redis fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

Linux Distros Unpatched Vulnerability : CVE-2026-63639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload th...

SUSE SLES15 Security Update : redis7 (SUSE-SU-2026:3636-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3636-1 advisory. This update for redis7 fixes the following issue: - CVE-2026-66373: remote code execution via a RESTORE payload where the same NACK pending...

DEBIAN-CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

AZL-96885 CVE-2026-63639 affecting package valkey for versions less than 8.0.10-1

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...