Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write

Description The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across...

Linux Distros Unpatched Vulnerability : CVE-2026-78675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file...

PT-2026-81916

Name of the Vulnerable Software and Affected Versions Compliance-trestle versions prior to 3.12.4 Compliance-trestle versions 4.0.0 through 4.0.3 Description Compliance-trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. The catalog-generate, profile-generate, a...

RHEL 8 : gstreamer1-plugins-good (RHSA-2026:59179)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59179 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

Linux Distros Unpatched Vulnerability : CVE-2026-56702

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP...

Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Overview The Kaltura HTML5 Player V2 Library mwEmbed / html5lib contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases tha...

PT-2026-81178

Name of the Vulnerable Software and Affected Versions Mane theme for WordPress versions prior to 1.8 Description The Mane theme for WordPress contains a Local File Inclusion flaw. This allows unauthenticated attackers to include and execute arbitrary files on the server, which can lead to the...

PT-2026-81446

Name of the Vulnerable Software and Affected Versions Reachy Mini versions prior to 1.8.2 Description The Reachy Mini daemon exposes the '/api/media/sounds/upload' endpoint, implemented by the upload sound function, without authentication, file-extension checks, content validation, or size...

PT-2026-81154

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An arbitrary file read issue exists in the TagReference.create function. A positional reference parameter allows the bypass of the unsafe option guard, enabling attackers to provide a reference...

The vulnerability of the ext4_ext_correct_indexes() function in the fs/ext4/extents.c module of the Ext4 file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ext4extcorrectindexes function in the fs/ext4/extents.c module of the Ext4 file system in the Linux operating system is related to the execution of operations outside of the buffer boundaries. Exploitation of this vulnerability could allow an attacker to compromise the...

The vulnerability of the netfs_retry_read_subrequests() function in the fs/netfs/read_retry.c file of the Netfs file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the netfsretryreadsubrequests function in the fs/netfs/readretry.c file of the Netfs file system in the Linux operating system is related to the repeated use of previously released memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

The vulnerability of the log_conflict_inodes() function in the fs/btrfs/tree-log.c file of the Btrfs file system’s kernel in the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the logconflictinodes function in the fs/btrfs/tree-log.c file of the Btrfs file system in the Linux operating system is related to synchronization errors. Exploiting this vulnerability can allow an attacker to cause service failures...

RHEL 9 : gstreamer1-plugins-good (RHSA-2026:59152)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59152 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages conta...

Vim < 9.2.0845 Command Injection (CVE-2026-73073)

The version of Vim installed on the remote host is prior to 9.2.0845. It is, therefore, affected by a command injection vulnerability: - StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tag...

RockyLinux 8 : gstreamer1-plugins-good (RLSA-2026:59179)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:59179 advisory. gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow CVE-2026-18296 gstreamer: GStreamer: Remote code execution v...

PT-2026-81140

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media directory Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem...

PT-2026-81729

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in the Safebrowsing component allows a remote attacker to bypass system access restrictions by using a crafted file. Recommendations Update Google Chrome to...

PT-2026-81395

Name of the Vulnerable Software and Affected Versions Kaltura HTML5 player mwEmbed / html5lib versions 2.x and earlier Description A local file disclosure issue exists due to improper validation of the ServiceUrl parameter in the 'mwEmbedLoader.php' endpoint. This parameter, intended as the base...

The vulnerability of the llist_abort_desc() function in the drivers/dma/idxd/submit.c module of the Intel Data Accelerator driver for the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the llistabortdesc function in the drivers/dma/idxd/submit.c module of the Intel Data Accelerator driver for the Linux operating system is related to the use of an invalid file descriptor. Exploiting this vulnerability could allow a remote attacker to compromise the...

PT-2026-81517

Name of the Vulnerable Software and Affected Versions SonicWall NetExtender Linux client affected versions not specified Description A path traversal issue exists within the OPSWAT tarball component. This flaw allows an attacker to write arbitrary files with root privileges. Path traversal is a...