PT-2026-126653

A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account...

PT-2026-127253

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldap filter, poisoning /personnalisation/config ldap.inc.php and permitting remote code...

CVE-2026-78845

Several Aidot products are vulnerable to Remote Code Execution (RCE) due to an issue in UPnP root description parsing . The affected devices include the Linkind Matter Smart Plug (version 1.01.32), OREiN Matter Smart Light Bulb (version 3.15.21), and the Linkind Wi-Fi Smart Light Bulb (version 3....

ROS-20261027-73-0043

The vulnerability in rabbitmq-server is related to improper handling of web page structures. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

PT-2026-127243

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

TencentOS Server 3: unbound (TSSA-2026:1211)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1211 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Planet Technology Planet WGS-804HPT Improper Neutralization of Special Elements Used in an OS Command (CVE-2024-52320)

PLANET WGS-804HPT is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: redis (UTSA-2026-146134)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146134 advisory. Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to...

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

PT-2026-127264

Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-127258

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

PT-2026-127288

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-127260

Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-127262

Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-127261

Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

WordPress Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Contributor+ PHP Object Injection to Remote Code Execution vulnerability discovered by moochi in WordPress Plugin Rank Math SEO versions = 1.0.276...

Planet Technology Planet WGS-804HPT Stack-Based Buffer Overflow (CVE-2024-48871)

PLANET WGS-804HPT is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution. This plugin only works with...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: redis (UTSA-2026-146130)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146130 advisory. Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to caus...

TencentOS Server 4: php (TSSA-2026:1204)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1204 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...