PT-2026-85781

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

PT-2026-86247

CVE-2026-50894: Unrestricted file upload in easyadmin v2.0.2.2 enables authenticated RCE and full server takeover. CVSS not scored, but impact is critical. If you use easyadmin, restrict access and audit uploads now. Patch https://t.co/GZLmhBXY4r cybersecurit valtersit CVE CVEAlert infosec SysAdm...

CVE-2026-31020

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106455)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106455 advisory. GStreamer MRF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106462 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

PT-2026-85695

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...

CVE-2026-85694: Improper Control of Generation of Code

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

CVE-2026-85604: Improper Control of Generation of Code

Grav before 2.0.18 affected versions = 2.0.17 contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrapper in GravExtension.php hardcodes Twig's isSandboxed argument to false, so unlike |map/|filter/|reduce, |sort accepts a plain function name inside the sandbox; t...

CVE-2026-71620: Unrestricted Upload of File with Dangerous Type

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

CVE-2026-82923: Missing Authorization

The AI Website Builder WordPress plugin GitHub build 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into th...

CVE-2026-19224: Improper Control of Generation of Code

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-44402: Unrestricted Upload of File with Dangerous Type

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive without valid credentials. Attackers can supply a...

CVE-2026-18658: Improper Neutralization of Special Elements used in an SQL Command

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

CVE-2026-75431: Use of Hard-coded Cryptographic Key

PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...

MiracleLinux 9 : gimp-3.0.4-4.el9_8.10 (AXSA:2026-1755:10)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1755:10 advisory. gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow CVE-2026-59090 gimp: GIMP: Arbitrary code execution via crafted TIF fil...

CVE-2026-75430: Missing Authentication for Critical Function

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-75429: Improper Authentication

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

CVE-2026-79423: Improper Neutralization of Special Elements used in an OS Command

An authenticated remote code execution RCE vulnerability in the adminconfig.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2026-71624: Improper Control of Generation of Code

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...

OpenCode Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability that can allow a remote attacker to obtain a session identifier and execute arbitrary commands through the session shell endpoint. This proof of concept retrieves an available session and demonstrate...