A vulnerability in Autodesk Fusion desktop application allows a maliciously crafted dynamic library loaded via the TextCommands.LoadDll command to execute arbitrary code. This occurs due to an exposed dangerous function that can be triggered when loading a DLL from an arbitrary path. The vulnerability has a high severity rating with a CVSS score of 7.8.
A local privilege escalation vulnerability exists in Veeam Agent for Linux when managed by a Veeam Backup & Replication instance. This flaw allows a user with limited privileges to escalate their rights on the affected system. The vulnerability is rated high severity with a CVSS score of 7.3. No specific affected versions or patches are detailed in the available information.
A stored cross-site scripting (XSS) vulnerability exists in the Autodesk Fusion desktop application due to a maliciously crafted HTML payload embedded in the description of an electronic library (.lbr) file. When such a library is imported and its description displayed in the Library Manager, the payload can execute arbitrary code or read local files within the context of the application process. This vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-103593 is a stack-based buffer overflow vulnerability in the Fireware OS logging service. It allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate. The vulnerability has a high severity score of 7.1. No affected versions or patch information are provided.
CVE-2025-8869 is a critical security advisory related to Red Hat AI Base Images 3.0.7 (ROCm). The advisory references multiple CVEs affecting Red Hat AI and OpenShift AI products. One detailed vulnerability, CVE-2025-13327, involves arbitrary code execution via specially crafted ZIP archives during package installation using the uv tool, requiring user interaction. No fixes are currently available for these issues according to the vendor advisory.
A vulnerability was found in OpenSSL affecting Red Hat AI Base Images 3.4.6 (ROCm 7.1). The flaw occurs when applications directly call low-level CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions with non-block-aligned lengths on hardware-accelerated builds, potentially exposing 1-15 trailing bytes of a message in cleartext. This exposure bypasses authentication, allowing reading or tampering of those bytes without detection. However, typical OpenSSL usage via higher-level EVP APIs, TLS, and FIPS modules are not affected. Red Hat rates the impact as low for its products and currently has no fix available that meets their criteria.
CVE-2026-108325 is a vulnerability in Tanium Reputation where sensitive information could be inserted into log files. This issue affects versions 6.6 prior to 6.6.145, 6.7 prior to 6.7.138, and 6.8 prior to 6.8.162. Tanium has fixed this vulnerability in versions 6.6.145, 6.7.138, and 6.8.162. The CVSS 3.1 base score is 6.6, indicating a medium severity level.
CVE-2026-108304 is a local privilege escalation vulnerability in the Tanium Endpoint Configuration Toolset Solution affecting End-User Notifications. The flaw involves improper link resolution before file access, also known as 'link following'. Tanium has released fixes for multiple affected versions to address this issue. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-116647 is a vulnerability in Tanium Comply involving improper neutralization of formula elements in CSV files. This flaw relates to insufficient output sanitization, which could allow an attacker to inject malicious formula content into CSV exports. Tanium has addressed this issue in fixed versions 2.32.263, 2.35.323, and 2.37.326. The vulnerability has a high severity rating with a CVSS score of 7.1.
A heap-based buffer overflow vulnerability exists in the Tanium Endpoint Configuration Toolset Solution. This flaw was addressed by Tanium in multiple fixed versions. The vulnerability has a high severity score of 7.8 and can lead to complete compromise of confidentiality, integrity, and availability if exploited.
Hydra core versions 1.3.6 through 1.3.7 and 1.4.0.dev9 through 1.4.0rc2 have a vulnerability in the legacy target blacklist that omits unsafe PyYAML loading functions. This allows an attacker who controls the target and arguments passed to instantiate() to execute arbitrary Python code via a malicious YAML configuration. The issue affects legacy no-whitelist paths and is not a bypass of Hydra 1.4's execution whitelist. The vulnerability is fixed in versions 1.3.8 and 1.4.0rc3.
CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It occurs in the ooTrace() trace-logging function due to an unbounded vsprintf write into a fixed 2048-byte buffer. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.
CVE-2026-114598 is a high-severity vulnerability in EPICS Base versions up to and including 7.0.10. It involves insufficient validation of element or length values in network messages, which can cause the application to read beyond allocated buffer boundaries. This flaw may lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-114597 is a vulnerability in EPICS Base versions up to and including 7.0.10 where improper validation of length or element values in network messages can cause out-of-bounds reads. This flaw may lead to denial of service and potential exposure of adjacent memory contents.
TinyMCE versions from 7.9.3 up to but not including 7.9.4 and from 8.5.1 up to but not including 8.9.3 contain a stored cross-site scripting (XSS) vulnerability in the media plugin. The vulnerability arises because elements created through data-mce-object are inserted into the active document before proper sanitization, allowing malicious scripts to execute. This issue has been fixed in versions 7.9.4 and 8.9.3.
CVE-2026-57197 is a heap-based buffer overflow vulnerability in Asterisk's handling of OGG/Speex audio packets. It occurs due to an unbounded memcpy operation in the format_ogg_speex component when processing corrupted Speex audio files. An attacker must supply a crafted audio file and have it played by Asterisk, requiring elevated privileges or administrator cooperation. This flaw can cause Asterisk to crash. The issue is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11, 22.8-cert3.
A vulnerability in authd allows improper validation of user identities when matching accounts from identity providers. This flaw could enable an attacker to gain unauthorized access to another user's local account and files, potentially exposing sensitive information. The issue affects versions prior to 0.7.1, including 0.6.1, 0.6.1ubuntu0.1, and 0.7.0. A fix is available in version 0.7.1, and users are advised to update and restart authd to apply the patch.
Adobe Substance 3D Painter contains a stack-based buffer overflow vulnerability that can lead to arbitrary code execution with the privileges of the current user. Exploitation requires user interaction, specifically opening a crafted malicious file. The vulnerability affects versions from 0 up to and including 12.1.5. The CVSS score is 7.8, indicating high severity.
Adobe Creative Cloud Desktop Application versions up to 6.10.0.252.41 are affected by an Uncontrolled Search Path Element vulnerability (CWE-427). This flaw could allow a low-privileged attacker to execute arbitrary code in the context of the current user if the victim opens a malicious file. The vulnerability requires user interaction for exploitation. It has a high severity with a CVSS score of 7.3.