Linux Distros Unpatched Vulnerability : CVE-2026-116738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via...

AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146998 advisory. A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are add...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147022)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147022 advisory. An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different maste...

ArubaOS 10.4.x < 10.4.1.14 / 10.7.x < 10.7.2.7 / 10.8.x < 10.8.1.2 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-10 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted...

MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loadmodel function. The...

CVE-2026-104317: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-110196: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs...

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explain...

CVE-2026-109618-exploit

PHP2Shell — CVE-2026-109618 / CVE-2026-109619 Unauthenticated Remote Code Execution in PHP 5.4.0 – 8.5.11 all web servers. CVSS 9.2 Critical · Patched 2026-10-21 · CISA KEV 2026-10-26 For authorized security testing only — on systems you own or have explicit written permission to test. Use withou...

CVE-2026-54453

Prior to version 0.10.0 , OpenCATS is vulnerable to persistent arbitrary PHP execution due to an injection flaw in the SettingsUI (manageProfessional) feature. The application fails to safely escape administrator-controlled license key input before reconstructing it into a PHP define() statement ...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

Exploit for CVE-2026-115905

Stopping RCE: you can't execute what you don't have !A malic...

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...

Prototype Pollution

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object property...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object proper...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via the propertyPath parameter in AccordionMenu.ts, where user-controlled property path segments are applied to an object without validation. An authenticat...

Prototype Pollution

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via Point.setNestedProperty in ts/Core/Series/Point.ts, which splits a dot-separated key path and traverses...

CVE-2026-114053

A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution in the server process. By submitting a crafted multimodal request specifying an attacker-controlled code revision, an attacker can cause the application to load and execute...

CVE-2026-78674 Remote Code Execution via BPMN System REST APIs in Multiple WSO2 Products Permits Arbitrary Command Execution

The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the execution of arbitrary commands on the server. An authenticated user can leverage this vulnerability to execute arbitrary commands with the...