PT-2026-84388

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Deserialization of untrusted data in the machine learning component allows remote code execution through object injection. An attacker can use a specially crafted trained model artifact...

VulnCheck KEV: CVE-2025-40553

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication...

PT-2026-84483

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Authenticated path traversal vulnerabilities exist in API endpoints. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folde...

PT-2026-84229

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...

PUB-A-497824503

In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation...

ALSA-2026:62170 Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

ASB-A-503544522

In multiple functions of rwt3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

VulnCheck KEV: CVE-2025-60702

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the system.so binary. The setDiagnosisCfg function retrieves the ipDoamin parameter from user input via websGetVar and concatenates it directly into a ping system command executed via...

VulnCheck KEV: CVE-2026-9586

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

PT-2026-84557

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue exists in WebRTC, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use aft...

PT-2026-84522

Name of the Vulnerable Software and Affected Versions Laravel Excel versions 3.1.8 through 3.1.69 Description The MaatwebsiteExcelFilesDisk::copy function in src/Files/Disk.php resolves the $destination variable, provided via Excel::store, $export-store, or storeExcel, against the process working...

PT-2026-84157

LibreNMS versions = 23.10.0 and getDevice-hostname is concatenated into shell commands ssh, virsh list/dumpxml/domstate in VminfoLibvirt.php and passed to exec without escapeshellarg or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands,...

PT-2026-84153

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration parameter is passed to shell exec without proper validation. An authenticated administrator can modify the snmpget configuration to point to a malicious executable...

PUB-A-474600296

In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-509576805

In sdecodevuiparam of fwhevcdecheader.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-84219

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.0.3 Description An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the...

Ray < 2.52.0 Remote Code Execution (CVE-2025-62593)

The Ray Dashboard service running on the remote host is prior to version 2.52.0. It is, therefore, affected by a remote code execution vulnerability: - Ray's browser-based attack protection relies solely on checking that the User-Agent header starts with 'Mozilla'. The Fetch specification allows...

PT-2026-84545

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue exists in the Proxy component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

VulnCheck KEV: CVE-2026-83549

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

KLA91251 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1...