CVE-2026-110264 Integer Overflow or Wraparound in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

CVE-2026-110264

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to...

CVE-2026-110264

A critical integer overflow vulnerability (CVSS 10.0) exists in GitLab CE/EE (versions 7.0 through 19.5) due to a weakness in the Onigmo regular-expression engine. An unauthenticated user could execute arbitrary code on a self-managed server by providing a specially crafted regular expression. Th...

CVE-2025-65855

CVE-2025-65855 HelpFlash IoT OTA Update Multiple Vulnerabilities Summary Multiple vulnerabilities in the OTA firmware update mechanism of Netun Solutions HelpFlash IoT allow an attacker with brief physical access to execute arbitrary code. CVE ID: CVE-2025-65855 Severity: HIGH CVSS v3.1 Score: 7....

RLSA-2026:86907 Important: xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling CVE-2026-93516 xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests...

CVE-2025-65200

An issue was discovered in localstack version 4.9.2 that allows for arbitrary code execution . The vulnerability occurs when a user provides a web-accessible URL containing crafted content via the templateURL parameter in the _localstack/cloudformation/deploy endpoint. If exploited, the hosted co...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : Ghostscript vulnerabilities (USN-8949-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8949-1 advisory. Rick de Jager discovered that Ghostscript incorrectly handled memory under certain...

CVE-2025-65200

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...

EUVD-2025-211174

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...

SUSE SLES15: pgvector-devel / postgresql16-pgvector / postgresql17-pgvector / etc (SUSE-SU-2026:4804-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4804-1 advisory. This update for pgvector fixes the following issue: - CVE-2026-103484: database users with the ability to create an IVFFlat index can write...

PT-2026-121430

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...

Memory corruption vulnerabilities in PHP

Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web services can exploit these vulnerabilities via specially crafted HTTP requests to potentially achieve...

Linux Distros Unpatched Vulnerability : CVE-2026-95168

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the getrulesimportpaths in thefuck/corrector.py and Rule.frompath in...

Important: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in modproxyuwsgi CVE-2026-63718 httpd: httpd: Denial of Service via integer overflow in moddavfs...

cve-2025-2082-POV

CVE-2025-2082 – Function Pointer Overwrite PoV VCSEC-style This repository demonstrates a Proof of Vulnerability PoV simulating a critical memory corruption flaw inspired by CVE-2025-2082, discovered in Tesla's VCSEC Vehicle Controller Security component. The vulnerability allows an attacker to...

CHIRP-CodeExecution_via_Malicious_ImageFile

CHIRP — Arbitrary Code Execution via eval in Kenwood ITM Driver Product: CHIRP - An open-source project for programming Ham Radios. Affected Versions: URL: https://github.com/kk7ds/chirp, https://chirpmyradio.com Affected Versions: = chirp-next-20260814 CWE: CWE-95 Eval Injection Overview CHIRP's...

CVE-2025-48384

Overview of CVE-2025-48384 CVE-2025-48384 is a critical vulnerability in Git, the widely used distributed version control system. It involves improper handling of carriage return CR characters in configuration values, which can lead to path traversal issues during submodule checkouts. This flaw...

CVE-2026-96778

A flaw was found in Pillow. A remote attacker could exploit a heap buffer overflow vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS. This issue occurs when an application re-encodes an untrusted image into JPEG format while preserving specially crafted color...

brotli: Out-of-Bounds Write in Google Brotli Decoder

A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-35585 , a critical OS Command Injection vulnerability discovered in File Browser versions 2.0.0 through 2.33.1. The vulnerability exists in the "Custom Command Hooks"...