CVE-2026-120433: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

CVE-2026-55261: Google Android: In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing…

In nfat4tnfceestorerxbuf of nfanfceeact.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ALSA-2026:93439 Important: libXi security update

X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow CVE-2026-109089 For more details about the security issues, including the...

PT-2026-135356

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...

Apple RawCamera 9420 Canon sRAW Heap Out-Of-Bounds Write

Apple RawCamera version 9420 contains a heap out-of-bounds write in its Canon sRAW decoder. A crafted CR2 proof of concept bypasses geometry validation and causes a negative row step to write before the pixel buffer. https://packetstorm.news/download/238925...

CVE-2026-120315: lobehub chat: LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to…

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile. Attackers can create a file record via file.createFile with a traversal name, then trigger document parsin...

libXi security update

1.7.10-8.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293452 1.7.10-8.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293398...

WordPress 7.0.1 REST API Batch Route Confusion Remote Code Execution

WordPress version 7.0.1 contains a REST API batch-route confusion issue which, when chained with an authornotin SQL injection issue, can allow unauthenticated remote code execution. This submission provides a proof of concept report for the wp2shell vulnerability chain...

RHEL 10 : libXi (RHSA-2026:93441)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:93441 advisory. X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090...

Linux Distros Unpatched Vulnerability : CVE-2026-120436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computin...

RHEL 9 : perl-HTTP-Daemon (RHSA-2026:93586)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:93586 advisory. The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers...

CVE-2026-86596: clavaque: The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <=…

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, = 260927 via the 'itemname' parameter parameter. This is due to insufficient sanitization in stripphptagsdeep, which only strips literal '' sequences, combined with a post-interpolation...

CVE-2026-116958: A flaw was found in konflux-ci

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

PT-2026-135447

Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with oversized offset table lengths to write controlled data past the...

CVE-2026-120435: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

PT-2026-135827

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 260928 Description Authenticated attackers with custom-level access and above can achieve remote code execution on the server. The issue exists in the IPN email template handling due to insufficient sanitization in t...

PT-2026-135805

The vulnerability is a Use-After-Free UAF in the EVS AIDL HAL, arising from a data race on an unsynchronized std::weak ptr within EvsEnumerator::openCamera. Specifically, concurrent calls from a privileged UID e.g., AID AUTOMOTIVE EVS can cause a torn weak ptr state, leading to a virtual call...

Apache Camel AWS2S3Utils Code Execution

The vulnerability in the AWS2S3Utils.determineKey function within the camel-aws2-s3 component of the Apache Camel Java framework is related to improper handling of special elements used in the expression language operator. Exploitation of this vulnerability may allow a remote attacker to execute...

Google Chrome Microsoft Edge Code Execution

The vulnerability in the Bluetooth components of Google Chrome and Microsoft Edge is related to memory usage after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code via a specially crafted Chrome extension...

WebUSB Component Code Execution

The vulnerability in the WebUSB component of Google Chrome and Microsoft Edge is related to use-after-free memory usage. Exploitation of this vulnerability may allow an attacker to execute arbitrary code via a malicious peripheral device...