PT-2026-89611

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description An authenticated attacker can execute arbitrary code because the security scanner uses an incomplete denylist. A denylist is a security mechanism that explicitly lists prohibited items...

CVE-2026-68006

An issue in Puma versions v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file. While the vulnerability is documented across multiple sources, including NVD , Debian , and Ubuntu , specific details regarding the root cause or exploi...

CVE-2026-81049: Missing Support for Integrity Check

Dell ThinOS 10, versions prior to 260510.2616, contain a Missing Support for Integrity Check vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution...

CVE-2026-80351: Improper Neutralization of Directives in Dynamically Evaluated Code

Improper neutralization of directives in dynamically evaluated code 'eval injection' vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : FFmpeg vulnerabilities (USN-8716-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8716-1 advisory. It was discovered that FFmpeg incorrectly handled certain crafted media files in the VobSub subtitle demuxer. An...

ALSA-2026:66432 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes:...

GHSA-2R5Q-H53F-9RP3 @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

github.com/gohugoio/hugo: Hugo: Stored Cross-Site Scripting via unescaped code-fence attribute values

A flaw was found in Hugo's default fenced-code-block renderer. This vulnerability allows a remote attacker to inject arbitrary script code into the rendered HTML by providing specially crafted input in the code-fence info string. Due to improper escaping of attribute values, a malicious quote can...

Malicious code in @nexustechpro/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fed8b2b0be012012aa9b1716e58c6d9e9a7302e431d5f8945e7b1196b6d7afab @nexustechpro/baileys is a fork of the WhatsApp library baileys in which lib/Socket/chats.js 270 KB is heavily obfuscated obfuscator.io-style rotatin...

DBI: Incomplete fix for CVE-2026-14380 DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546...

Important: Red Hat Security Advisory: perl-DBI security update

An update for perl-DBI is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Security Bulletin: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core

Summary Upgrade to new jsonListener.jar Vulnerability Details CVEID:CVE-2026-13006 DESCRIPTION: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing...

CVE-2026-36433

An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code via the Production.dll and RdiskUpgrade.exe components...

Malicious code in discord-mfa-solver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...

CVE-2026-71613

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdecprocess function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859...

CVE-2026-71612

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmxprocess function. Fixed in fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6...

CVE-2026-71614

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier and gfm2tsipdatagramreader components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938...

CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

Vulnerabilities in Ivanti Neurons for ITSM

Ivanti has addressed several vulnerabilities in Ivanti Neurons for ITSM. A malicious individual could exploit these vulnerabilities to perform unauthorized actions, including executing arbitrary code on the server. Ivanti released an update in version 2026.2 to fix these vulnerabilities. See the...

CVE-2026-85102 Improper Certificate Validation in Quantum Security Gateway

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway...