PT-2026-58802

Name of the Vulnerable Software and Affected Versions Media Encoder affected versions not specified Description An out-of-bounds write occurs when a program writes data past the end of a designated memory buffer, which can lead to memory corruption. This issue could result in arbitrary code...

PT-2026-58790

Name of the Vulnerable Software and Affected Versions Creative Cloud Desktop affected versions not specified Description A Time-of-check Time-of-use TOCTOU Race Condition exists, which is a software bug where a program checks the state of a resource and then acts on that resource, but the state...

PT-2026-58788

Name of the Vulnerable Software and Affected Versions Adobe Bridge affected versions not specified Description An integer overflow or wraparound occurs when an application attempts to create a value that exceeds the maximum size of the integer type used to store it. This issue allows for arbitrar...

PT-2026-58840

Name of the Vulnerable Software and Affected Versions Illustrator affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious file...

PT-2026-60080

Name of the Vulnerable Software and Affected Versions Anyquery affected versions not specified Description When running in server mode, the software fails to restrict native SQLite disk manipulation commands. Unauthenticated attackers connecting to the MySQL-compatible server port can use the...

The vulnerability of the contains_dotdot() function in the RDP client FreeRDP allows a hacker to read and write arbitrary files.

The vulnerability of the contains.dot function in the RDP client FreeRDP is related to a single-byte offset error. Exploiting this vulnerability could allow an attacker to read and write arbitrary files remotely...

Ubuntu 24.04 LTS / 26.04 LTS : libssh2 vulnerabilities (USN-8532-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8532-1 advisory. It was discovered that libssh2 incorrectly handled certain publickey subsystem attributes. A remote attacker controlling a malicious SSH serv...

Oracle Linux 8 : nginx:1.24 (ELSA-2026-38847)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38847 advisory. - Resolves: RHEL-188406 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-4205...

APSB26-83 : Security update available for Adobe Animate

Adobe has released an update for Adobe Animate. This update resolves critical vulnerabilities. Successful exploitation could lead to arbitrary code execution...

MiracleLinux 9 : nginx:1.26 (AXSA:2026-1252:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1252:01 advisory. nginx: NGINX: Arbitrary Code Execution Vulnerability CVE-2026-42945 Tenable has extracted the preceding description block directly from the MiracleLinux...

vitest: Vitest: Arbitrary code execution and information disclosure via path traversal

A flaw was found in Vitest, a testing framework. On Windows, the Vitest UI/API server incorrectly handled file serving, which could allow an attacker to read sensitive files outside the project directory. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading ...

vitest: Vitest: Arbitrary code execution via crafted browser-runner URL

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the...

CVE-2026-62239

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the downloadandcopy function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the...

CVE-2026-15682

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in orde...

CVE-2026-15681

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...

CVE-2026-15684

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

CVE-2026-15681 AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...

CVE-2026-15681

Summary: CVE-2026-15681 affects AnyDesk. The flaw is in the handling of screen recording files: by creating a junction, a local attacker can cause the service to create arbitrary files, leading to a denial-of-service condition. Exploitation requires low-privilege code execution on the target syst...

Laravel-Mediable: path traversal vulnerability in the File::sanitizePath()

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath function that allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination. Attackers can exploit the permissive...