CVE-2026-78403: Thalesgroup Sentinel Keys Server: Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows…

Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. ...

PT-2026-133283

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

AlmaLinux 9.6 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793354956)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793354956 advisory. - BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers t...

PT-2026-133640

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions 0.9.0 through 0.18.0 Description An unauthenticated remote attacker can execute arbitrary operating system commands with the privileges of the api server process. This occurs when the server receives specially crafte...

CVE-2026-76012: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

VulnCheck KEV: CVE-2026-119977

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window...

Linux Distros Unpatched Vulnerability : CVE-2026-76028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code...

PT-2026-133434

🔴 Dahua Intelligent Connection Center: remote code execution via command injection CVE-2025-31704 A remote attacker can send a specially crafted request to run arbitrary commands on the affected system. Patch → V5.000.0000000.15 https://t.co/0JpnCOlkWo...

CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

VulnCheck KEV: CVE-2025-11201

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw...

VulnCheck KEV: CVE-2026-116512

The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' parameter parameter. This is due to unsanitized 'id' parameter value concatenated...

PT-2026-133767

Name of the Vulnerable Software and Affected Versions ThemeREX Royal Event versions prior to 2.0 Description Deserialization of untrusted data allows for object injection. An attacker can inject malicious PHP objects, which may lead to remote code execution on the site. Recommendations At the...

CVE-2026-119264: Google Chrome: Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-119266: Google Chrome: Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-119268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

CVE-2026-76028: Google Chrome: Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary…

Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-119270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the...

CVE-2026-119268: Google Chrome: Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-3353)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3353 advisory. GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreame...

CVE-2026-119265: Google Chrome: Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...