CVE-2026-84171 WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server...

PT-2026-90718

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause...

Linux Distros Unpatched Vulnerability : CVE-2026-90558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit...

PT-2026-90780

My 4th official CVE is now assigned: 🔐 Notepad++ 🐞 Stack-based Buffer Overflow ⚠️ High Severity 💥 CVE-2026-85279 A vulnerability in the plugin loading mechanism leading to potential arbitrary code execution. The comeback continues. 🗿🔥 CyberSecurity CVE BugBounty https://t.co/RiRptj80NP...

PT-2026-90728

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc in wasm rt allocate funcref table wasm2c/wasm-rt-impl-tableops.inc. When the funcref table allocation...

CVE-2026-89688

A flaw was found in the Linux kernel's nfsd component. During a seqidop replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue could allow an attacker to potentially cause a denial of...

CVE-2026-89495

A flaw was found in ocfs2 in the Linux kernel. A malicious or compromised node within a Distributed Lock Manager DLM cluster can send specially crafted messages with unchecked length fields. This can lead to a heap out-of-bounds write, potentially allowing for arbitrary code execution, or an...

CVE-2026-48490

ArduinoCore-avr (the source code and configuration files of the Arduino AVR Boards platform) contains a stack-based buffer overflow in its floating-point concatenation path. Versions prior to 1.8.8 are affected. Passing values near the extremes of the float or double range to String::concat(float...

MAL-2026-16139 Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause...

CVE-2026-87987

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks by placing environment variable assignments before allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to trigger c...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-87986

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval...

CVE-2026-87985

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

EUVD-2026-76120

An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval...

CVE-2026-87985

Mistral Vibe contains an arbitrary code execution vulnerability caused by ANSI-C quoted arguments that bypass command permission checks. Because these arguments are not properly inspected, an attacker can craft an allowlisted command to execute arbitrary code on the user's system without requirin...

Vulnerability was concealed in N-central of N-able

N-able discovered a vulnerability in N-central versions prior to 2026.3.1.14. The vulnerability involves a pre-authentication remote code execution flaw. An attacker can execute arbitrary code on the affected system remotely, without any form of authentication. All installations running on...