CVE-2026-19219: Insufficient Verification of Data Authenticity

In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders the file browser reads from, writes to,...

CVE-2026-78657: Improper Limitation of a Pathname to a Restricted Directory

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-14982: Improper Limitation of a Pathname to a Restricted Directory

The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...

CVE-2026-84326: Use of Uninitialized Resource

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

ROS-20260902-73-0008

The vulnerability in mongodb-org is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-84609

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

RockyLinux 10 : wget (RLSA-2026:62142)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62142 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution or...

Important: gimp:2.8 security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: gimp: Sta...

Path traversal vulnerability in file-parameters can lead to RCE

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor and binding submitted data to their arguments. file-parameters validates...

RockyLinux 9 : gegl04 (RLSA-2026:62170)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:62170 advisory. gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 Tenable has extracted the preceding description block directly fr...

RockyLinux 8 : gimp:2.8 (RLSA-2026:62507)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62507 advisory. gimp: gimp: Stack buffer overflow in pnmscannergettoken CVE-2026-58380 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on...

Sangoma Switchvox SQL Injection Vulnerability

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution...

CVE-2026-53649: Missing Authentication for Critical Function

Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data content type, cross-origin JavaScrip...

CVE-2026-84353: Use After Free

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-84793

Jenkins Performance Plugin 1015.v09ca 52b 3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on...

CVE-2026-10821: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

Marimo 0.20.4 - RCE

Title: Marimo 0.20.4 - RCE Date: August 2nd, 2026 Exploit Author: Jason Bernier Vendor Homepage: https://marimo.io/ Software Link: https://github.com/marimo-team/marimo Version: str: """Send command to target and receive output""" try: if not conn: print"- No active connection" return ""...

CVE-2026-19116: Deserialization of Untrusted Data

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

The vulnerability of the http.cookies.Morsel.jsOutput() method in the Python programming language interpreter (CPython) allows a hacker to execute arbitrary code. [source-iocs-preserved method=http.cookies.Morsel.js_output()]

The vulnerability of the http.cookies.Morsel.jsOutput method in the Python programming language interpreter CPython is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a remote attacker to exploit the system. source-iocs-preserved...

RHEL 9 : gegl04 (RHSA-2026:62170)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62170 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...