EUVD-2026-102534

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code...

CVE-2026-92777

A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device protections and execute arbitrary code...

CVE-2026-75941

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code...

Important: mount-s3

Issue Overview: Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted...

CVE-2025-52097

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...

GitLab Regular Expression Code Execution

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the use of a regular expression, which does not sufficiently restrict the set of allowed values. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

CVE-2026-95182

An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...

CVE-2026-95182

An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...

CVE-2026-95182: Untrusted Search Path

An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...

CVE-2026-62439: Integer Overflow or Wraparound

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

UBUNTU-CVE-2026-111458

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

PT-2026-115623

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

CVE-2026-88755

The software Z.ai ZCode v3.11.2.6792 is vulnerable to arbitrary code execution because it automatically establishes connections with MCP servers defined within a repository's workspace configuration. An attacker could potentially exploit this by tricking a user into opening a crafted repository ....

Red Hat: CVE-2026-62439: gimp: gimp: file-pvr Plug-in PVR File Parsing Integer Overflow Heap-based Buffer Overflow Vulnerability

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

CVE-2026-88755

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

EUVD-2026-102903

An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...

EUVD-2025-211106

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...

PT-2026-115624

Name of the Vulnerable Software and Affected Versions DeepSeek Harness dsh version c291e796 Description An untrusted search path allows attackers to execute arbitrary code by supplying and opening crafted executable files instead of legitimate content. Recommendations At the moment, there is no...

PT-2026-115616

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...

CVE-2026-111458

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...