Microsoft Edge (Chromium-based) buffer error vulnerability

Microsoft Edge Chromium-based versions from 1.0.0.0 up to and including 154.0.4258.37 contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow and may allow unauthorized attackers to execute code over the network...

IBM Langflow OSS code injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a code injection vulnerability. This vulnerability stems from improper handling of certain elements within the code, potentially allowing authenticated remote attackers to execute arbitrary code...

PT-2026-132871

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the GarbageCollection component, which can allow a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to open a...

PT-2026-132874

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in the Quota component. This allows a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a specially...

PT-2026-132879

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue in Skia allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after free is a...

PT-2026-132886

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the Network component, which could allow a remote attacker to potentially execute arbitrary code inside the sandbox by inducing the user to visit a crafted...

PT-2026-132877

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue in Blink allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after free is a...

PT-2026-132883

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption in the Autofill component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page...

ArubaOS 10.4.x < 10.4.1.14 / 10.7.x < 10.7.2.7 / 10.8.x < 10.8.1.2 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-10 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted...

CVE-2026-92744: Delinea Privilege Manager: Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as…

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

PT-2026-132471

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

VulnCheck KEV: CVE-2026-104995

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

CVE-2026-115245: Unknown Chat AI with Dispatcher: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and earlier affected releases contain out-of-memory corruption and stale global state flaws that can allow unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache. https://packetstorm.news/download/238177...

KLA91383 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in MediaStream can be exploited remotely to execute...

WordPress 7.1.3 Brotli Decoder Remote Code Execution

WordPress version 7.1.3 Docker Official Image includes a vulnerable Brotli decoder. A proof of concept uses an unauthenticated XML-RPC pingback to trigger crafted Brotli decoding and execute a fixed command in the supplied isolated lab. https://packetstorm.news/download/238156...

PT-2026-130634

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

PT-2026-132334

A path traversal vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

PT-2026-132212

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data...

CVE-2026-18894: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...