PT-2026-132857

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions 9.1 and earlier version 9 builds Description A member of the Veeam Virtualization Extensions Users group can perform remote code execution on servers running the Veeam Management Pack...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loadmodel function. The...

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explain...

PT-2026-132856

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions 9.1 and earlier version 9 builds Description An authenticated Windows domain user can perform remote code execution as the LocalSystem account on servers running the Veeam Management...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and prior to 2025.0.4. These vulnerabilities stem from path traversal and may allow a compromised Host Administrator to access locations outside their authorized scope and execute remote code...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-146998)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146998 advisory. A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are add...

Linux Distros Unpatched Vulnerability : CVE-2026-116738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147032 advisory. A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remot...

PT-2026-133295

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.1.3 Description An unauthenticated attacker can perform PHP Object Injection via a Post Custom Field with a List input type. The issue occurs because the GFFormsModel::create post function passes submitted...

PT-2026-132334

A path traversal vulnerability in Progress Software WS FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

PT-2026-132868

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in Frames, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use aft...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

PT-2026-132872

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption in Dawn allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-132878

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Improper input validation in CacheStorage allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-132885

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in the FileSystem component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially...

PT-2026-132887

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the FileSystem component, which could allow a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted...

CVE-2026-109618-exploit

PHP2Shell — CVE-2026-109618 / CVE-2026-109619 Unauthenticated Remote Code Execution in PHP 5.4.0 – 8.5.11 all web servers. CVSS 9.2 Critical · Patched 2026-10-21 · CISA KEV 2026-10-26 For authorized security testing only — on systems you own or have explicit written permission to test. Use withou...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...