Rocky Linux 9.6 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793354956)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793354956 advisory. - BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-119264

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

CVE-2026-119408: n8n-io n8n: n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via…

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden...

PT-2026-133729

Name of the Vulnerable Software and Affected Versions GStreamer affected versions not specified Description A flaw exists in the gst-plugins-bad H.266/VVC parser. Processing a malformed H.266 media file or stream can trigger an integer overflow while parsing profile, tier, and level fields,...

CVE-2026-119713: paperclipai @paperclipai/server: Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders…

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

PT-2026-134135

Name of the Vulnerable Software and Affected Versions Thales Sentinel Keys Server versions prior to 1.3.8.0 Description A stack-based buffer overflow and missing authorization issue exists in the HTTP handler of the software on Windows. The server fails to validate the length of the first field i...

CVE-2026-119269: Google Chrome: Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code…

Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-134481

Name of the Vulnerable Software and Affected Versions Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress versions prior to 1.2.0 Description Insufficient file path validation in the post delete assessment file by id function allows for arbitrary file deletion on the server...

Important: dotnet8.0

Issue Overview: Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute code over a network. CVE-2026-102870 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3367)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3367 advisory. Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute code over a network. CVE-2026-102870 Allocation of resources without limits o...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : .NET vulnerabilities (USN-8958-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8958-1 advisory. It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could...

VulnCheck KEV: CVE-2026-103039

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::createpost passing the submitted value to WordPress' unrestricted global maybeunserialize rather...

CVE-2025-31704: Dahua Intelligent Connection Center: A vulnerability has been found in the Dahua Intelligent Connection Center

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution...

CentOS Linux 6 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-libs / bind-sdb / bind-utils Multiple Vulnerabilities (CENTOS6:CLSA-2026:1793085399)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1793085399 advisory. - In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit...

PT-2026-133700

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert palette images to truecolor function. This is due to insufficient file type validation before processing uploaded files. This...

astro-notion-blog 0.13.0 Path Traversal / Remote Code Execution

astro-notion-blog version 0.13.0 allows Notion database editors to supply an encoded FeaturedImage filename that escapes the image directory during site builds, overwrites an Astro page, and enables code execution as the build user. https://packetstorm.news/download/238545...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

CVE-2026-116852: Marketing Fire Widget Options: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Author Remote Code Execution RCE in Widget Options = 4.2.5 versions...

PT-2026-133690

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

PT-2026-134415

Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH...