The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers allows a hacker to escalate their privileges and execute arbitrary code. This vulnerability is present in programs like cPanel & WHM, Plesk.

The vulnerability of the backup and data restoration plugins on Acronis Backup software for computers and servers is related to improperly used standard permissions. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary code remotely...

The vulnerability of the EmailTrack component in the cPanel web hosting control panel allows a hacker to execute arbitrary code and gain full control over the server.

The vulnerability of the EmailTrack component in the cPanel web hosting control panel is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain full control over the server...

The vulnerabilities of the ASN.1 software for network security management and the network interface devices Check Point Security Gateway and Check Point Spark Firewall allow attackers to execute arbitrary code.

The vulnerability of the ASN.1 software for network security management and the network interface devices Check Point Security Gateway and Check Point Spark Firewall are related to buffer overflow in dynamic memory. Exploitation of this vulnerability could allow a malicious actor to execute...

CVE-2026-92946: Improper Control of Dynamically-Managed Code Resources

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes nodemodules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via...

CVE-2026-92980: Unrestricted Upload of File with Dangerous Type

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-52727: Use of Hard-coded Cryptographic Key

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-50158: External Control of File Name or Path

yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/caption/download.go and passes it to Caption.Download in pkg/caption/caption.go, where os.Create creates or truncates that...

CVE-2026-71538: Improper Neutralization of Special Elements used in an OS Command

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

CVE-2026-54626: Heap-based Buffer Overflow

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGAINDEXEDRLE path selected by imagetype == 9 allocates an image buffer using the one-byte-per-pixel SAILPIXELFORMATBPP8INDEXED format returned by...

RHEL 8 : gstreamer1-plugins-base (RHSA-2026:68503)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68503 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a...

CVE-2026-81475: Missing Authentication for Critical Function

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-86320: Improper Control of Generation of Code

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-62104: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in Migratico Lite = 2.6.8 versions...

KLA91293 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Network can be...

CVE-2026-93373: Use After Free

Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. Chromium security severity: High...

EulerOS 2.0 SP15 : libinput (EulerOS-SA-2026-3808)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

CVE-2026-93374: Use After Free

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

EulerOS 2.0 SP15 : EDK2 (EulerOS-SA-2026-3800)

According to the versions of the EDK2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow...

CVE-2026-92939: Process Control

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

CVE-2026-92937: Improper Control of Generation of Code

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host...