PT-2026-133700

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert palette images to truecolor function. This is due to insufficient file type validation before processing uploaded files. This...

VulnCheck KEV: CVE-2026-103039

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::createpost passing the submitted value to WordPress' unrestricted global maybeunserialize rather...

CVE-2026-119578: Project-MONAI MONAI: MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows…

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algofromjson that allows attackers to run Python code via a crafted work directory's algoobject.json. Attackers can ship a malicious algorithmtemplates module plus a target name that is imported and...

PT-2026-133547

MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo from json that allows attackers to run Python code via a crafted work directory's algo object.json. Attackers can ship a malicious algorithm templates module plus a target name that is imported and...

CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

PT-2026-134135

Name of the Vulnerable Software and Affected Versions Thales Sentinel Keys Server versions prior to 1.3.8.0 Description A stack-based buffer overflow and missing authorization issue exists in the HTTP handler of the software on Windows. The server fails to validate the length of the first field i...

VulnCheck KEV: CVE-2026-58115

A vulnerability has been identified in SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions V4.3.4.1 running Industrial OS with Node-RED installed. Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are...

CVE-2026-119269: Google Chrome: Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code…

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-133729

Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description A flaw exists in the gst-plugins-bad H.266/VVC parser. Processing a malformed H.266 media file or stream can trigger an integer overflow while parsing profile, tier, and level fields,...

PT-2026-133778

Name of the Vulnerable Software and Affected Versions FunnelKit Automations versions prior to 3.8.6.2 Description An unauthenticated attacker can send crafted serialized data to the application, leading to PHP Object Injection. This issue may allow for remote code execution or data tampering...

Linux Distros Unpatched Vulnerability : CVE-2026-119260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793085399)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793085399 advisory. - In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit...

Linux Distros Unpatched Vulnerability : CVE-2026-119261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox vi...

CentOS Linux 6 [TuxCare] Security Update: python-setuptools Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793083722)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793083722 advisory. - Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-119265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

PT-2026-134481

Name of the Vulnerable Software and Affected Versions Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress versions prior to 1.2.0 Description Insufficient file path validation in the post delete assessment file by id function allows for arbitrary file deletion on the server...

CVE-2026-76030: Google Chrome: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…

Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-119271: Google Chrome: Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code…

Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76025: Google Chrome: Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary…

Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76026: Google Chrome: Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary…

Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...