Important: gstreamer1-plugins-good

Issue Overview: GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit...

Linux Distros Unpatched Vulnerability : CVE-2026-47884

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an / mapping that results in view rendering, and where the...

Amazon Linux 2023 : gstreamer1-plugins-good, gstreamer1-plugins-good-gtk (ALAS2023-2026-2121)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2121 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer...

RHEL 9 : gimp (RHSA-2026:61587)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61587 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...

PT-2026-84022

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description The checkExtractItems function in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Due to the absence of .phtml, .phar, .php5, a...

CVE-2026-83497: Deserialization of Untrusted Data

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

Important: gimp security update

The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fixes: gimp: GIMP:...

Langflow 1.8.4 - Path Traversal to Remote Code Execution

Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution Google Dork: N/A Date: 2026-07-20 Exploit Author: cardosource Vendor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: Dictstr, Any: return "target": target.rstrip'/', "lhost"...

CVE-2026-12894: Improper Neutralization of Special Elements Used in a Template Engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-81891: Unrestricted Upload of File with Dangerous Type

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

ROS-20260831-73-0003

The vulnerability of the cryptorsacommon function in the libfreerdp/crypto/crypto.c file of the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause a service failure...

RHEL 8 : freerdp (RHSA-2026:61251)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61251 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...

Amazon Linux 2 : gstreamer1-plugins-good (ALAS-2026-3899)

The version of gstreamer1-plugins-good installed on the remote host is prior to 1.18.4-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3899 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability...

F5 Networks BIG-IP : NLnet Labs Unbound vulnerability (K000163139)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.5 / 17.5.1.9 / 21.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K000163139 advisory. NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validat...

ROS-20260831-73-0005

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-83683

Improper Limitation of a Pathname to a Restricted Directory Path Traversal vulnerability in ash-project ash admin allows writing attacker-controlled bytes to arbitrary paths on the server. AshAdmin.Components.Resource.Form.consume file uploads/1 builds the destination as Path.jointmp dir,...

Important: gstreamer1-plugins-good

Issue Overview: GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target must visit...

PT-2026-83848

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.2 Description An unauthenticated remote code execution issue exists in the ProfilePress WordPress plugin. Unauthenticated attackers can install and activate arbitrary plugins by brute-forcing a weak 32-bit...

CVE-2026-66047: Missing Authentication for Critical Function

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

Linux Distros Unpatched Vulnerability : CVE-2026-42211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized...