CVE-2026-63090 ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the modsftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component...

CVE-2026-12484

A flaw was found in Keras, specifically within the keras.layers.TorchModuleWrapper.fromconfig method. This vulnerability allows an attacker to perform unsafe deserialization of PyTorch pickle data. By processing untrusted Keras layer configurations, a local attacker could exploit this flaw, leadi...

USN-8560-1: libXfont vulnerabilities

It was discovered that libXfont incorrectly handled scaling bitmap fonts, leading to a heap buffer overflow. An attacker able to access the X server could use this issue to cause libXfont to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2026-56001 It was...

USN-8561-1: FreeRDP vulnerabilities

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code...

CVE-2026-41855

A flaw was found in Spring Framework. In an untrusted Java Message Service JMS environment, the MappingJackson2MessageConverter and JacksonJsonMessageConverter components allow for arbitrary class instantiation. This vulnerability can be exploited by a remote attacker through gadget class...

SUSE-SU-2026:22801-1 Security update for python-cryptography

This update for python-cryptography fixes the following issues - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270208. - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-...

dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure

A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system...

dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure

A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system...

CVE-2026-52656

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file...

IBM Langflow OSS code injection vulnerability (CNVD-2026-31204)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

PT-2026-61672

Name of the Vulnerable Software and Affected Versions DNG SDK versions 1.7.1 2536 and earlier Description A Stack-based Buffer Overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent memory. This issue...

Adobe ColdFusion 2023.x < 2023u22 / 2025.x < 2025u11 Multiple Vulnerabilities (APSB26-82)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 22 or 2025.x update 11. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-82 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

TencentOS Server 2: perl-IO-Compress (TSSA-2026:0652)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0652 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

PT-2026-62023

It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause FreeRDP to crash, resulting in a denial of service, or execute arbitrary code...

The vulnerability of Windows operating system DHCP clients allows a perpetrator to execute arbitrary code.

The vulnerability of DHCP clients of Windows operating systems relates to the possibility of using memory after it is freed. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...

The vulnerability of the siman.exe executable file of Rockwell Automation Arena’s discrete event simulation and automation software allows a hacker to execute arbitrary code.

The vulnerability of the siman.exe executable file of Rockwell Automation Arena’s discrete event simulation and automation software is related to the execution of operations beyond the buffer in memory due to incorrect validation of input data. Exploiting this vulnerability can allow an attacker ...

The vulnerability of the TorchModuleWrapper.from_config() function in the Keras library allows a hacker to execute arbitrary code.

The vulnerability of the TorchModuleWrapper.fromconfig function in the Keras library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update (Important) (RHSA-2026:42080)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42080 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

The vulnerability of the linker.exe executable of Rockwell Automation Arena’s discrete event simulation and automation software allows a attacker to execute arbitrary code.

The vulnerability of the linker.exe executable of Rockwell Automation Arena’s event simulation and automation software is related to the execution of operations beyond the buffer boundaries in memory, resulting from incorrect validation of input data. Exploiting this vulnerability allows an...

The vulnerability of the Content Credentials SDK libraries, related to the use of an unreliable search path, allows a perpetrator to execute arbitrary code.

The vulnerability of Content Credentials SDK library libraries is related to the use of an unreliable search path. Exploiting this vulnerability could allow a attacker to execute arbitrary code...