CVE-2023-50461: Incorrect Authorization

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

CVE-2026-82793: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product...

PT-2026-91835

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...

CVE-2026-13293: Deserialization of Untrusted Data

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary code on the system due to the...

CVE-2026-64752: Out-of-bounds Write

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing a maliciously crafted image may lead to arbitrary code execution...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.12.20260914 or dnf...

CVE-2026-61701: Deserialization of Untrusted Data

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

PT-2026-91625

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-84506: Use After Free

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to execute arbitrary code with kernel privileges...

CVE-2026-82770: Buffer Copy without Checking Size of Input

Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed...

CVE-2026-90949: Out-of-bounds Write

A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting...

EUVD-2023-60687

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

The vulnerability of the Adobe Experience Manager content and media management system, related to deficiencies in authentication procedures, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Experience Manager content and media management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the fact that functions from an unreliable controlled area can be enabled, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

RockyLinux 9 : nginx:1.24 (RLSA-2026:67308)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67308 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLinu...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:4095-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4095-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...

Linux Distros Unpatched Vulnerability : CVE-2026-90949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a...

CVE-2023-32778

ILIAS (a learning management system) is vulnerable to arbitrary code execution via ZIP upload in versions 6.23, 7 before 7.22, and 8.1. The CNA-assigned CVSS v3.1 score is 3.3 (Low) , reflecting a network vector with high attack complexity and high privileges required , with low impact to confide...

PT-2026-91097

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product...

PT-2026-91431

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.0, and 12.0.1.0 through 12.0.12.27 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...