Linux Distros Unpatched Vulnerability : CVE-2026-61725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker- supplied 7z archive can write or overwrite files outside...

Security update for rsyslog (critical)

openSUSE security update: security update for rsyslog ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22184-1 Rating: critical References: bsc1257604 bsc1271910 bsc1272414 bsc1274610 bsc1275926 bsc1281628 bsc1285036 bsc1286162 bsc1286926...

Security update for epiphany (important)

openSUSE security update: security update for epiphany ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22199-1 Rating: important References: bsc1275932 bsc1276758 Cross-References: CVE-2026-77679 CVE-2026-77682 Affected Products: openSUSE Leap 16.0...

CVE-2026-119977: WordPress Foundation WordPress: WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window...

ManageEngine ADAudit Plus Build 8605 Vulnerability Scanner

ManageEngine ADAudit Plus versions before build 8606 contain an unauthenticated remote code execution issue in the Agent API. This tool fingerprints HTTP services, identifies exposed Agent API endpoints, and reports detected build versions...

E-UDE: A Scientific Machine Learning Model for Malware Propagation Dynamics

Understanding the malware propagation dynamics over the Internet is crucial for effectively controlling its spread. Existing mechanistic and data-driven models in the context of malware propagation dynamics, have some issues with either interpretability or predictive accuracy. This study presents...

Linux Distros Unpatched Vulnerability : CVE-2026-107050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker- supplied code in their uid, leading to arbitrary code...

AlmaLinux 9 : bind9.18 (ALSA-2026:93072)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:93072 advisory. bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-19630 bind: bind: Arbitrary code execution via GSS-TSIG UDP messa...

Rocky Linux 8 [CIQ] Security Update: aspell / aspell-debuginfo / aspell-debugsource / aspell-devel (crlsa-2026_92615)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202692615 advisory. aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 Tenable has extracted the preceding description block directly from the CIQ...

WordPress IvyForms 1.5.1 Shell Upload

WordPress IvyForms plugin version 1.5.1 and earlier contains an arbitrary file upload vulnerability that allows a user with custom form-editing access to configure executable extensions and upload a PHP payload through a published form. https://packetstorm.news/download/238670...

Apache ActiveMQ Classic 5.18.2 OpenWire Remote Code Execution

Apache ActiveMQ Classic version 5.18.2 is vulnerable to remote code execution through unsafe deserialization of OpenWire ExceptionResponse data. This proof of concept supplies a local Docker lab, version checker, and Spring XML generator for CVE-2023-46604. https://packetstorm.news/download/23867...

Anyscale Ray 2.8.0 Job Submission API Code Execution

Anyscale Ray versions 2.6.3 and 2.8.0 allow remote attackers to execute arbitrary code via the unauthenticated job submission API. https://packetstorm.news/download/238680...

CVE-2026-116964: A flaw was found in konflux-ci

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest...

CVE-2026-76010: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the renderimage function. This is due to unrestricted mass assignment of caller-supplied metadata keys onto the image model...

PT-2026-134527

libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc decoder mixed interleave::processTile that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF file declaring, for example, 16-bit Cb and...

PT-2026-134514

Name of the Vulnerable Software and Affected Versions WebDyne versions 2.022 through 3.021 Description Unauthenticated clients can access application source code through the viewer on the default index page. Wrapper scripts, such as webdyne.psgi, enable this index page by default. The source view...

Linux Distros Unpatched Vulnerability : CVE-2026-107347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to...

Joern 4.0.669

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

PT-2026-134513

Name of the Vulnerable Software and Affected Versions WebDyne versions 2.031 through 3.021 Description WebDyne incorrectly identifies files as Perl pages if the string .psp appears anywhere in the filename. This occurs because the regular expression WEBDYNE PSP EXT RE used to determine if a file...

Linux Distros Unpatched Vulnerability : CVE-2026-116366

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary...