Security Advisory 0203

Security Advisory 0203 PDF Date: November 2, 2026 Revision | Date | Changes ---|---|--- 1.0 | November 2, 2026 | Initial release 1.1 | November 3, 2026 | Remove Wifi-AP from affected products to unaffected products. Move additional products from under triage to unaffected products. The CVE-ID...

PT-2026-135803

The report details a heap Use-After-Free UAF vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unordered map. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to...

CVE-2026-58868: Google Android: In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-135624

Name of the Vulnerable Software and Affected Versions DJ-Classifieds versions prior to 3.11.3 Description The DJ-Classifieds Joomla extension contains a flaw that allows an authenticated user without elevated privileges to upload arbitrary files. This issue can lead to remote code execution RCE,...

PT-2026-135262

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile. Attackers can create a file record via file.createFile with a traversal name, then trigger document parsin...

CVE-2026-102435: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient…

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

PT-2026-135815

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

PT-2026-135450

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges produce more than 5000 points, overflowing the coord stack arr...

PT-2026-135452

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimensions so jbg dec merge planes overflows...

Linux Distros Unpatched Vulnerability : CVE-2026-120433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an...

Google Chrome Code Execution

The Accessibility component vulnerability in Google Chrome is related to a buffer overflow in memory. Exploitation of this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

GFX Component Code Execution

The vulnerability in the GFX component of Google Chrome and Microsoft Edge is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

GeoDjango Spatial Search Code Execution

The spatial search vulnerability in the GeoDjango software platform for Django web applications is related to improper external handling of filenames or file paths. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Incus Container Management System Code Execution

The vulnerability in the Incus container management system and virtual machine manager is related to an incorrect file access reference. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

D-Link DIR-505 Wireless Router Code Execution

The vulnerability in the main function of the /secmark1524.cgi script within the Web Management CGI interface of the D-Link DIR-505 wireless router software is related to the presence of undocumented configuration commands. Exploitation of this vulnerability may allow a remote attacker to execute...

Payments component Code Execution

The vulnerability in the Payments component of Google Chrome and Microsoft Edge is related to use-after-free memory usage. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted HTML page...

Node.js 24.22.0 Brotli Decoder Remote Code Execution

Node.js version 24.22.0 contains an out-of-bounds write in the Brotli decoder. A proof of concept demonstrates remote code execution through a crafted Brotli-compressed HTTP request. https://packetstorm.news/download/238892...

PT-2026-135828

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM set annot callout line that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add freetext annot can supply four o...

CVE-2026-120752: PyMuPDF: PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that…

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

Linux Distros Unpatched Vulnerability : CVE-2026-104064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloadertiff TIFF loader that allows attackers to trigger a...