ROS-20260901-73-0017

The vulnerability of the option-name validation component in the Python library for interacting with Git repositories, GitPython, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands...

PUB-A-469414216

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

KLA91249 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Security...

PT-2026-84142

Name of the Vulnerable Software and Affected Versions Lutece Core versions prior to 7.1.8 Description An issue in the XSL export management module allows authenticated administrators to execute arbitrary code on the server. The XML/XSLT processing configuration fails to enable secure processing...

PT-2026-84545

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue exists in the Proxy component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-84557

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue exists in WebRTC, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use aft...

PT-2026-84522

Name of the Vulnerable Software and Affected Versions Laravel Excel versions 3.1.8 through 3.1.69 Description The MaatwebsiteExcelFilesDisk::copy function in src/Files/Disk.php resolves the $destination variable, provided via Excel::store, $export-store, or storeExcel, against the process working...

PT-2026-84424

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Insecure file operations within the API allow an authenticated remote attacker to achieve remote code execution. This flaw enables the execution of arbitrary commands a...

CVE-2026-19952: Improper Limitation of a Pathname to a Restricted Directory

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the movefolders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

EUVD-2026-69391

Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd. Tenda A18 v.15.13.07.09 allows a remote attacker to execute arbitrary code via the fromSetCmdlineRun function...

CVE-2026-73749: Improper Access Control

Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted packets to the affected service. Successful exploitation could result in remote code...

VulnCheck KEV: CVE-2025-60702

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input via websGetVar and concatenates it directly into a ping system command executed via...

VulnCheck KEV: CVE-2026-9586

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

VulnCheck KEV: CVE-2026-83549

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

VulnCheck KEV: CVE-2023-39470

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists with...

CVE-2026-73765: Improper Limitation of a Pathname to a Restricted Directory

Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...

CVE-2026-83549: Improper Neutralization of Special Elements used in an OS Command

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-73752: Improper Limitation of a Pathname to a Restricted Directory

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...

CVE-2026-73701: Improper Control of Generation of Code

An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticate...