Google Chrome Microsoft Edge Code Execution

The vulnerability in the Views component of Google Chrome and Microsoft Edge is related to use-after-free memory allocation. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code via a specially crafted HTML page...

ksmbd module Code Execution

The vulnerability in the ksmbd module of the SMB server implementation in Linux kernel is related to race conditions. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Apache OpenOffice Code Execution

The vulnerability in the Apache OpenOffice office suite package is related to the use of an untrusted search path. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

NGINX Plus/Open Source Module Code Execution

The vulnerability in the ngxhttpcoremodule of NGINX Plus and NGINX Open Source web servers is related to a heap-based buffer overflow. Exploitation of this vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service by sending a specially crafted HTTP request...

Google Chrome Microsoft Edge Code Execution

The vulnerability in the Compositing component of Google Chrome and Microsoft Edge is related to use-after-free memory allocation. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code via a specially crafted HTML page...

PT-2026-135454

QuickJS-NG before 0.16.0 contains an integer overflow in js proxy get own property names in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the allocation size, causing crashes or...

PT-2026-135718

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description A use-after-free memory safety issue exists in multiple locations. This flaw allows for remote code execution without requiring additional execution privileges or user interaction...

PT-2026-135547

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench VEW could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to...

CVE-2026-73695: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in…

Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject...

CVE-2026-77876: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the…

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

Collabora Online Built-in CODE Server Before 26.4.303 OS Command Injection

Collabora Online Built-in CODE Server versions before 26.4.303 contain an unauthenticated OS command injection vulnerability in proxy.php that can result in remote code execution when the CODE server is not running...

PT-2026-135680

In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

PT-2026-135714

Name of the Vulnerable Software and Affected Versions Google Android Framework versions 14 through 17 Description A heap buffer overflow exists in the Android Framework component, specifically within the onOutputReceived function in FrameDecoder.cpp. This flaw allows an out-of-bounds write to occ...

Linux Distros Unpatched Vulnerability : CVE-2026-104062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to...

RHEL 8 : freerdp (RHSA-2026:93549)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93549 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

MiracleLinux 8 : aspell-0.60.6.1-23.el8_10 (AXSA:2026-2230:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2230:01 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the...

RHEL 9 : nginx (RHSA-2026:93467)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93467 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage...

RHEL 10 : perl-HTTP-Daemon (RHSA-2026:93585)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93585 advisory. The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 server...

RHEL 8 : freerdp (RHSA-2026:93538)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93538 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

RHEL 8 : libXi (RHSA-2026:93438)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93438 advisory. X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090...