PT-2026-115624

Name of the Vulnerable Software and Affected Versions DeepSeek Harness dsh version c291e796 Description An untrusted search path allows attackers to execute arbitrary code by supplying and opening crafted executable files instead of legitimate content. Recommendations At the moment, there is no...

PT-2026-115616

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...

CVE-2026-111458

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

MiracleLinux 8 : flatpak-1.12.9-7.el8_10 (AXSA:2026-2074:06)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2074:06 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via...

Adobe Substance 3D Sampler < 6.0.4 Multiple Vulnerabilities (APSB26-159)

The version of Adobe Substance 3D Sampler installed on the remote host is prior or equal to 6.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-159 advisory. - Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in...

Debian dla-4839 : gir1.2-gst-plugins-bad-1.0 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4839 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4839-1 [email protected]...

EUVD-2026-102905

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

CVE-2026-75941: Deserialization of Untrusted Data

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on the same logical network to execute arbitrary code...

Microsoft Excel Code Execution

The vulnerability of Microsoft Excel spreadsheet editors within the Microsoft Office and Microsoft 365 Apps for Enterprise software packages is related to reading data beyond the allowed range in memory. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

Adobe ColdFusion 2023.x < 2023 Update 26 / 2025.x < 2025 Update 14 Multiple Vulnerabilities (APSB26-144)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 26 or 2025.x update 14. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-144 advisory. - ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type...

CVE-2026-95182

An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...

CVE-2026-88755

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

CVE-2026-111458: Heap-based Buffer Overflow

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

CVE-2025-52097

Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-3233)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3233 advisory. Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client...

CVE-2026-95182

A vulnerability in DeepSeek Harness (dsh) , specifically in commit c291e796 , involves an untrusted search path (CWE-426). This flaw allows an attacker to achieve arbitrary code execution by supplying and opening crafted executable files that replace legitimate content. The impact is rated as CRI...

CVE-2026-88755: Improper Neutralization of Special Elements used in an OS Command

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...

FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the FIOSSHMLPGCNF...

Adobe Substance 3D Designer <= 16.0.5 Multiple Vulnerabilities (APSB26-169)

The version of Adobe Substance 3D Designer installed on the remote host is prior or equal to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-169 advisory. - Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in...

Debian dla-4838 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4838 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4838-1 [email protected]...