Security update for brotli

This update for brotli fixes the following issue: CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution bsc1287778. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you...

SUSE-SU-2026:4945-1 Security update for brotli

This update for brotli fixes the following issue: - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution bsc1287778...

CVE-2023-31446-Remote-Code-Execution

CVE-2023-31446-Remote-Code-Execution Repository contains description for CVE-2023-31446 discovered by Dodge Industrial Team for Dodge OPTIFY platfrom. CVE ID: CVE-2023-31446 Vendor: Cassia Networks Product: Cassia Gateway Firmware Version: http:///bypass/config?type=sqs&keyId=&key=&queueUrl= Base...

CVE-2026-96192

Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network...

CVE-2026-96198

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-96199

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-90866

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

CVE-2026-85890

Double free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-85897

Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-42701

Shop manager PHP Object Injection in YayMail = 4.4.6 versions...

CVE-2026-18894

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...

CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

CVE-2026-18894

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are...

CVE-2026-118079

Shop manager PHP Object Injection in FV Flowplayer Video Player = 8.3.4 versions...

CVE-2026-116864

Author PHP Object Injection in WPCargo Track & Trace = 8.0.5 versions...

CVE-2026-116865

Editor PHP Object Injection in Zippy = 1.7.0 versions...

CVE-2026-111732

P-Net before 1.0.3, when built with PNETOPTIONARVENDORBLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size buffer, without comparing it with the buffer size or the block...

CVE-2026-111730

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in getcheckpeer. The received length up to 255 was used to copy data into the 241-byte peer station name buffer and to place the terminating NUL byte, so a crafted block writes up to 15 bytes past the end o...

CVE-2026-110196

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs...

CVE-2026-110196

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs...