CVE-2026-16144

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

EUVD-2026-51755

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

CVE-2026-16144

The CVE-2026-16144 entry concerns Kali Forms ≤ 2.4.20 (WordPress plugin) with unauthenticated Remote Code Execution via the _save_data function. The root cause is insufficient validation of the _save_data() path when a form field value can overwrite a trusted placeholder, allowing attacker-contro...

CVE-2026-16144 Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the savedata function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callab...

CVE-2026-15601

The CVE affects the Kirki plugin for WordPress (versions

EUVD-2026-51745

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-15601

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

EUVD-2026-51652

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

EUVD-2026-51680

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

SUSE CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

RLSA-2026:48650 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...

vim security update

An update is available for vim. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

SUSE CVE-2026-66758

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

Debian dsa-6409 : libgd-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6409 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6409-1 [email protected] https://www.debian.org/security/...

PT-2026-67285

Name of the Vulnerable Software and Affected Versions FreeRDP Windows client versions prior to 3.29.0 Description A heap buffer overflow occurs in the clipboard virtual channel when processing CLIPRDR FILE CONTENTS RESPONSE PDUs Protocol Data Units because the server-provided size is not validate...

CVE-2026-34641

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-34641 Premiere Pro | Out-of-bounds Write (CWE-787)

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-34641

CVE-2026-34641 (Premiere Pro) is an out-of-bounds write vulnerability (CWE-787) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. This is supported by NVD and CVE listings that describe Prem...

MAL-2026-11424 Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

CVE-2026-68771

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...