CVE-2026-114550 libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific...

CVE-2026-114549

A heap-based buffer overflow exists in the NoMachine nxwebrunner web service, which listens on TCP port 4443 by default. The vulnerability is caused by a lack of proper validation of the length of user-supplied data before it is copied to a heap-based buffer. Remote attackers can exploit this fla...

CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web...

CVE-2026-118627 MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118627

The MLflow platform is susceptible to a Remote Code Execution (RCE) vulnerability (CWE-502) caused by the deserialization of untrusted data . The flaw specifically exists within the loading of SHAP explainer models , where the application fails to properly validate user-supplied data. An attacker...

CVE-2026-118627

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118623

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2026-118623

The MLflow software is vulnerable to a Remote Code Execution (RCE) vulnerability due to the unsafe deserialization of untrusted data. The flaw resides in the parsing of pickle files where the application fails to properly validate user-supplied data during the reconstruction of saved data objects...

CVE-2026-118623 MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2026-104608

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service babeld. babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with ...

CVE-2022-30267

Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution...

CVE-2022-30267

The Emerson Ovation system (specifically version 3.8.0 Feature Pack 1 and prior ) is vulnerable to insufficient verification of data authenticity (CWE-345 ). The root cause is a lack of authentication for firmware signing, where the system relies on an insecure checksum for integrity. This allows...

CVE-2022-30267 Emerson Ovation Insufficient Verification of Data Authenticity

Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity. This could allow an attacker to push malicious firmware images, cause a denial-of-service condition, or achieve remote code execution...

CVE-2026-104608

A remote code execution vulnerability exists in the Git service (babeld) of GitHub Enterprise Server . The issue stems from a use-after-free condition where babeld held references to internal collections while calling the SSH library; a re-entrant callback could then modify and invalidate those r...

CVE-2026-104608 Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service babeld. babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with ...

CVE-2026-120931

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

K000164091: GitLab vulnerabilities CVE-2026-85706, CVE-2026-87719, and CVE-2026-88765

Security Advisory Description CVE-2026-85706 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read...

CVE-2026-121189

An use after free flaw was found in the Browser component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/555547989 Mitigation --- CME Mitigation Guidance 2026-11-04 --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application o...

CVE-2026-121052

An use after free flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/569129173 Mitigation --- CME Mitigation Guidance 2026-11-04 --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an...

CVE-2026-121117

An use after free flaw was found in the Paint component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/575318807 Mitigation --- CME Mitigation Guidance 2026-11-04 --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of...