CVE-2026-96262: Stack-based Buffer Overflow

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowi...

Substance 3D Sampler Buffer Overflow RCE

The vulnerability of the Substance 3D Sampler software for creating textures and materials for 3D models involves writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2026-111100

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

Cisco NX-OS MPLS Operation Code Execution

The vulnerability of the MPLS Operation, Administration, and Maintenance OAM function in the Cisco NX-OS operating system of Cisco Nexus 3000 Series switches and Cisco Nexus 9000 Series switches is related to the release of previously unallocated memory. Exploiting this vulnerability can allow an...

CVE-2026-105410: Improper Neutralization of Input During Web Page Generation

A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...

CVE-2026-105408: Improper Neutralization of Input During Web Page Generation

A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...

CVE-2026-105407: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the server...

CVE-2026-108094: Use After Free

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wpimagedescriptionv1 resource while an asynchronous ICC file read is still in progress. When the read completes, the composit...

CVE-2026-21128: Improper Input Validation

Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch arbitrary activity with Samsung Checkout privileges...

CVE-2026-21122: Out-of-bounds Write

Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...

CVE-2026-21114: Out-of-bounds Write

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...

Important: perl-DBI

Issue Overview: A critical arbitrary code execution vulnerability CWE-94 found in the DBD::DBM database driver, which is a core component shipped within the Perl DBI Database Interface module. The flaw exists because the dbmtype and dbmmldbm handle attributes pass user-influenced input directly...

Important: perl-DBI

Issue Overview: A critical arbitrary code execution vulnerability CWE-94 found in the DBD::DBM database driver, which is a core component shipped within the Perl DBI Database Interface module. The flaw exists because the dbmtype and dbmmldbm handle attributes pass user-influenced input directly...

PT-2026-110683

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-57 ImageMagick versions prior to 7.1.2-32 Description An XML injection issue exists in the CIP encoder. The software fails to properly escape input-derived data when generating Cisco IP Phone XML output. Th...

PT-2026-110468

Name of the Vulnerable Software and Affected Versions Metasploit Framework affected versions not specified Description The post module post/apple ios/gather/ios image gather contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be...

PT-2026-110956

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware versions FW1060.00 through FW1060.81 Description A flaw exists in the service processor mailbox interface. An attacker with authenticated service-level access to the Flexible Service Processor FSP can send a speciall...

PT-2026-110917

🚨 CVE-2021-48011 Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI decodes before path.join in serveStaticFile and...

ROS-20261012-73-0165

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-110958

Name of the Vulnerable Software and Affected Versions IBM Power Systems Firmware versions FW1060.00 through FW1060.81 Description A flaw exists in the service processor mailbox interface. An attacker with authenticated service-level access to the Field Service Processor FSP can send a specially...

PT-2026-111095

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper output encoding allows a remote authenticated attacker to execute arbitrary JavaScript. This issue occurs when the application fails to correctly sanitize or encode data befo...