Apache ActiveMQ Classic 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ Classic version 5.18.2 is vulnerable to remote code execution through unsafe deserialization of OpenWire ExceptionResponse data. This proof of concept supplies a local Docker lab, version checker, and Spring XML generator for CVE-2023-46604. https://packetstorm.news/download/23867...

Anyscale Ray 2.8.0 Job Submission API Code Execution

Anyscale Ray versions 2.6.3 and 2.8.0 allow remote attackers to execute arbitrary code via the unauthenticated job submission API. https://packetstorm.news/download/238680...

WordPress IvyForms 1.5.1 Shell Upload

WordPress IvyForms plugin version 1.5.1 and earlier contains an arbitrary file upload vulnerability that allows a user with custom form-editing access to configure executable extensions and upload a PHP payload through a published form. https://packetstorm.news/download/238670...

PT-2026-134513

Name of the Vulnerable Software and Affected Versions WebDyne versions 2.031 through 3.021 Description WebDyne incorrectly identifies files as Perl pages if the string .psp appears anywhere in the filename. This occurs because the regular expression WEBDYNE PSP EXT RE used to determine if a file...

PT-2026-134514

Name of the Vulnerable Software and Affected Versions WebDyne versions 2.022 through 3.021 Description Unauthenticated clients can access application source code through the viewer on the default index page. Wrapper scripts, such as webdyne.psgi, enable this index page by default. The source view...

PT-2026-134487

Name of the Vulnerable Software and Affected Versions konflux-ci affected versions not specified Description A flaw allows an attacker with repository write access to achieve arbitrary code execution within the Continuous Integration and Continuous Delivery CI/CD workflow environment. The issue...

CVE-2026-116964: A flaw was found in konflux-ci

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest...

CVE-2026-76010: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the renderimage function. This is due to unrestricted mass assignment of caller-supplied metadata keys onto the image model...

PT-2026-134527

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc decoder mixed interleave::processTile that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and...

Joern 4.0.669

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-134516

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a user or email /...

Linux Distros Unpatched Vulnerability : CVE-2026-107347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to...

Rocky Linux 10.2 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc (crlba-2026_22541)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlba-202622541 advisory. GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability t...

Rocky Linux 9 [CIQ] Security Update: aspell / aspell-debuginfo / aspell-debugsource / aspell-devel (crlsa-2026_92458)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692458 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the CIQ...

RockyLinux 8 : hplip (RLSA-2026:82295)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82295 advisory. hplip: potential memory buffer overflow CVE-2020-6923 hplip: HP Linux Imaging and Printing Software - Use of DSA Key CVE-2025-43023 hplip: HPLIP: Multip...

Rocky Linux 9 [CIQ] Security Update: libXrender / libXrender-debuginfo / libXrender-debugsource / etc (crlsa-2026_91057)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202691057 advisory. libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats CVE-2026-88807 Tenable has extracted the preceding description block directly fr...

Linux Distros Unpatched Vulnerability : CVE-2026-119722

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA...

KLA91385 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in SVG can be exploited...

Linux Distros Unpatched Vulnerability : CVE-2026-116366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-92616)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92616 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...