CVE Vulnerabilities - 24 September 2026

Decepticon can run attacker commands from web pages

CVE-2026-61732 GHSA-g5f9-3xfg-p9mf PYSEC-2026-4034

Versions of Decepticon before 1.1.17 insert raw web‑crawl results into the language‑model prompt without cleaning special tokens. If a malicious page’s text includes those tokens, the model treats the...

10.0

HFS2 allows outsiders to read, change, delete any file

CVE-2026-97360

Versions of HFS2 up to 2.4.0 let anyone on the network read, modify, add to, or delete files that the HFS service can reach, even outside the shared folder. This can expose private data, corrupt infor...

10.0

HFS2 allows attackers to run code via crafted upload filename

CVE-2026-97359

Versions of HFS2 up to 2.4.0 let anyone upload a file with a specially crafted name that can cause the server to execute arbitrary commands. This can happen without any login, giving attackers control...

10.0

Dokploy allows authenticated user to run commands as root

CVE-2026-93425 GHSA-56g6-wjr4-5q7p

In Dokploy versions before 0.29.13, a user who is logged in and has read access can trick the system into running any command they choose with full administrator rights inside the Dokploy container. B...

9.9

OpenStack Zaqar allows unauthenticated queue access

CVE-2026-97404 DEBIAN-CVE-2026-97404 UBUNTU-CVE-2026-97404

OpenStack Zaqar versions before 22.0.2 on Debian can be tricked into accepting an empty signature header. An attacker who knows a project’s ID can then read, create, modify, or delete that project's q...

9.9

Velociraptor investigator can gain admin rights

CVE-2026-19072

In Velociraptor, a user with the investigator role can change an internal setting that lets them run any query on the server, bypassing normal permission checks. This means they could perform actions ...

9.9

Red Hat Ansible Automation Platform 2.4 may let attackers run code

RHSA-2026:71115

The automation-controller-venv-tower component in Red Hat Ansible Automation Platform 2.4 can be tricked into executing unauthorized commands. This could let a malicious user take control of the autom...

9.9

Red Hat Ansible Automation Platform 2.5 may let attackers run code

RHSA-2026:71114

Several components of Red Hat Ansible Automation Platform 2.5, including the automation controller, receptor, gateway proxy, gateway server, and a Python library, contain a coding error that could let...

9.9

Red Hat Automation Controller and Receptor may allow unauthorized actions

RHSA-2026:71113

Several parts of Red Hat Ansible Automation Platform 2.6—including Automation Controller, Receptor, Automation Gateway Proxy, and the Python SQL parsing libraries—contain weaknesses that could let an ...

9.9

Red Hat OpenShell packages could allow privilege escalation

RHSA-2026:70694

The OpenShell, OpenShell Gateway, and Python3-OpenShell packages from Red Hat contain a flaw that could let a malicious user gain higher system privileges. This can lead to unauthorized access or cont...

9.9

GitLab could let logged-in user run code

CVE-2026-93577 BIT-gitlab-2026-93577

A flaw in GitLab's build pipeline processing could let someone who is signed in upload a specially crafted script and cause the server to run unwanted code. This affects all versions before the latest...

9.9

GitLab allows logged-in user to run code on server

CVE-2026-89078 BIT-gitlab-2026-89078

Versions of GitLab Community and Enterprise Edition released before 19.2.7, 19.3.3, and 19.4.1 have a flaw that could let a signed‑in user cause the server to execute their own code. The problem occur...

9.9

IO::Socket::SSL::SelfCertificate 1.00 runs hidden Python code

CVE-2026-97230

The Perl module IO::Socket::SSL::SelfCertificate version 1.00 contains a hidden script that downloads and runs Python code from an external web address when it is installed. This allows anyone who can...

9.8

Honeywell PD45 printer lets anyone upload and run files

CVE-2026-13249

The web management screen of the Honeywell PD45 industrial printer (firmware version F10.19.010040) lets anyone upload files without logging in. An attacker could place a malicious file and make the p...

9.8

Rocky IPA may allow crashes and unauthorized access

RLSA-2026:70564

The Rocky Linux Identity Management service (IPA) has several flaws that could let attackers crash the system, run unwanted code, or obtain admin credentials without logging in. These issues affect th...

9.8

QuickJS can overwrite memory, risking unauthorized code execution

CVE-2026-88378 UBUNTU-CVE-2026-88378 DEBIAN-CVE-2026-88378

A coding error in QuickJS (including the Debian and quickjs‑ng packages) can write data outside its intended area when reading a function tag, which could let an attacker run their own code. Update to...

9.8

minimp3 can miscalculate APEv2 tag size and crash

CVE-2026-88365

The minimp3 library may overflow a number when it reads the size field of an APEv2 tag. This can cause the program using the library to stop working or behave unexpectedly. Upgrade to the latest minim...

9.8

Linux kernel RDMA service can be tricked into reading huge memory

CVE-2026-97413 DEBIAN-CVE-2026-97413 UBUNTU-CVE-2026-97413 BELL-CVE-2026-97413

The Linux kernel’s RDMA service may accept a specially crafted network request that tells it a length larger than expected. This causes the system to calculate a massive size and try to read beyond it...

9.8

geelen mcp-remote can run attacker code remotely

CVE-2026-51996

Versions 0.1.16 through 0.1.38 of the geelen mcp-remote tool let an unauthenticated attacker execute their own code on the server by exploiting a function in the utils library. This could let an attac...

9.8

MPack 1.1.1 could crash on crafted data

CVE-2026-88351 UBUNTU-CVE-2026-88351

The MPack library version 1.1.1 on 32‑bit systems can mishandle specially crafted MessagePack messages, leading to memory corruption and possible service shutdown. This risk occurs when the software p...

9.8

Linux kernel RPC may retain old credentials

CVE-2026-93207 DEBIAN-CVE-2026-93207 UBUNTU-CVE-2026-93207 BELL-CVE-2026-93207

The Linux kernel's RPC authentication code could leave leftover credential data from a previous request when a request fails early. This stale information could be accessed later, potentially leading ...

9.8

Visual Composer Website Builder can load arbitrary files

CVE-2026-12227

The Visual Composer Website Builder plugin for WordPress lets anyone on the internet cause the server to load files it should not. By sending a specially crafted request, an attacker can make the site...

9.8

Red Hat Unbound may let attackers read DNS data

RHSA-2026:71459

The Unbound DNS resolver and its library in Red Hat can be tricked into revealing internal DNS information to an attacker. This could expose details about your network that should stay private. Update...

9.8

Unbound DNS server could be exploited to run code

RHSA-2026:70754

The Unbound DNS server and its Python packages have a flaw that could let an attacker execute commands on the system. This could compromise the server and any data it handles. Apply the latest securit...

9.8

Red Hat IPA may let attackers gain unauthorized access

RHSA-2026:70564

The Red Hat Identity Management packages (ipa, ipa-client and related components) contain flaws that could let an attacker bypass authentication or execute actions as a privileged user. This could exp...

9.8