Git patches six flaws, including code execution on recursive clones
Fixes ship in Git 2.56.1 and six older series; GitHub Enterprise Server should move to listed builds.
Stories per day · 30 days
5 RSS
Relatedsupply-chain5git4github4ubuntu4denial-of-service2perl2adobe1advisory1blazor1bod-26-041brotli1canonical1cisa-kev1cpan1cwe-941dir-locals1dotnet1emacs1
50 stories, newest first · one card per story
Stories tagged #code-execution
Emacs 31.1 .dir-locals.el flaw can run arbitrary code
X3r0Day reported inadequate validation; the oss-security post includes only a truncated files.el diff.
libheif can run code from crafted HEIF images
Ubuntu says opening a malicious HEIF file, by a user or automated system, could lead to arbitrary code execution.
Canadian advisory covers IBM MQ and Watson Speech flaws
CVE-2026-11724 allows arbitrary code execution in MQ file transfer; CVE-2026-17493 can cause a denial of service.
libnfs ZDR decoding flaw can crash the library or run code
Ubuntu says missing maximum-size enforcement during ZDR decoding causes an out-of-bounds write in libnfs.
CISA adds GPUStack improper authentication flaw to KEV (CVE-2026-102895)
Unauthenticated callers can change users and models, create admin API keys, read secrets, and execute code.
INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities
INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities that may allow local and remote attackers to execute arbitrary code.
TeamViewer clients before 15.83 let malicious hosts run code on viewers
CVE-2026-111585 is an integer overflow scored 8.8 and fixed in 15.83; TeamViewer reports no known exploitation.
1
Spreadsheet::XLSX before 0.19 allows code execution via ExcelFmt eval
A crafted Excel number-format condition is passed to Perl string eval inside ExcelFmt.
Ubuntu fixes .NET debug-proxy and Brotli flaws
The earlier Blazor debug-proxy fix in USN-8942-1 was incomplete and only dotnet10 and dotnet11 were affected.
Adobe, Veeam and Juniper patch critical code-execution flaws
None of the vendors reports exploitation; fixes cover cross-tenant code execution in Veeam and unauthenticated command execution in Session Smart.
Unsloth loader can run Python even with trust disabled
CVE-2026-93348, scored 8.6, is fixed in Unsloth 2026.8.20 and Unsloth Zoo 2026.8.14.
Godot 4.1.0–4.7.2: code execution via .po Plural-Forms header
The .po loader stores an unvalidated Plural-Forms header; it was runtime-confirmed on official 4.7-stable and not found in 3.5.
PHP warns of unlikely code-execution flaw CVE-2026-115560
Disable session upload progress until a routine release; the October 21 PHP2Shell patches do not fix it, and no attacks are reported.
Exploit-DB lists remote code execution in Titan MFT Server 26.0.0
The public entry names South River Technologies Titan MFT Server 26.0.0 and gives no patch or exploitation status.
JQ::Lite before 2.51 executes Perl from query regexes (CVE-2026-78497)
The Perl module compiles a query regular expression with string eval, running embedded Perl code.
USN-8925-1: YAML-LibYAML vulnerabilities
Ubuntu patched YAML-LibYAML flaws that could delete files or run code on 16.04 and 18.04 LTS.
[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177
Vim before 9.2.1177 allows arbitrary code execution through Ruby omni-completion; no CVE yet.
USN-8912-1: Perl DBI module vulnerabilities
Ubuntu's USN-8912-1 patches Perl DBI flaws that may allow code execution or denial of service.
MXC - a sandboxed code execution system
Microsoft published MXC, a sandboxed code-execution system discussed on Hacker News.
USN-8896-1: GStreamer Ugly Plugins vulnerabilities
Ubuntu patches GStreamer Ugly Plugins flaws that could run code from crafted RealMedia or ASF files.
USN-8891-1: librsvg vulnerability
Ubuntu reports a librsvg flaw that may allow denial of service or arbitrary code execution.
USN-8882-1: Tesseract vulnerabilities
Ubuntu’s USN-8882-1 fixes Tesseract flaws in crafted .traineddata models that can crash the engine or execute code.
CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
Perl YAML before 1.27_001 can overwrite package variables and enable code execution.