PT-2026-132874

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in the Quota component. This allows a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a specially...

PT-2026-132879

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue in Skia allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after free is a...

PT-2026-132886

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the Network component, which could allow a remote attacker to potentially execute arbitrary code inside the sandbox by inducing the user to visit a crafted...

CVE-2026-92744: Delinea Privilege Manager: Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as…

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

KLA91383 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in MediaStream can be exploited remotely to execute...

PT-2026-132877

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue in Blink allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use after free is a...

PT-2026-132883

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption in the Autofill component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page...

CVE-2026-115245: Unknown Chat AI with Dispatcher: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

PT-2026-132471

A buffer overflow vulnerability in the Brotli decoder c/dec/decode.c in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially...

ArubaOS 10.4.x < 10.4.1.14 / 10.7.x < 10.7.2.7 / 10.8.x < 10.8.1.2 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-10 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 and earlier affected releases contain out-of-memory corruption and stale global state flaws that can allow unauthenticated remote code execution. This proof of concept targets PHP 8.4.26 with Apache. https://packetstorm.news/download/238177...

Microsoft Edge (Chromium-based) buffer error vulnerability

Microsoft Edge Chromium-based versions from 1.0.0.0 up to and including 154.0.4258.37 contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow and may allow unauthorized attackers to execute code over the network...

WordPress 7.1.3 Brotli Decoder Remote Code Execution

WordPress version 7.1.3 Docker Official Image includes a vulnerable Brotli decoder. A proof of concept uses an unauthenticated XML-RPC pingback to trigger crafted Brotli decoding and execute a fixed command in the supplied isolated lab. https://packetstorm.news/download/238156...

VulnCheck KEV: CVE-2026-104995

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

PT-2026-132855

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions prior to 13.1.0.334 Description An unauthenticated attacker can perform remote code execution RCE on servers running the Veeam Virtualization Extensions service. This allows the attack...

IBM Langflow OSS code injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection vulnerability. This vulnerability allows remote attackers to trigger pre-stored Python component code within public workflows, which then executes in the server process using the runtime context of the flow owner. As a result...

IBM Langflow OSS deserialization injection vulnerability

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a deserialization injection vulnerability. This vulnerability arises from deserializing untrusted data, allowing remote attackers to execute arbitrary code by accessing the message broker...

Frappe path traversal vulnerability

Versions prior to Frappe 15.121.0 and versions 16.x prior to 16.34.0 contain a path traversal vulnerability. This vulnerability arises because file upload processing fails to validate target paths before writing them to disk. As a result, authenticated attackers may upload specially crafted files...

CVE-2023-7357: Revera FlexNet Publisher: A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interface

A remote code execution RCE vulnerability was identified in the FlexNet Publisher lmadmin web user interface. This vulnerability is addressed in the FlexNet Publisher 2023 R2 11.19.4.0 release...

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explain...