openSUSE 16: dovecot24 / dovecot24-backend-mysql / dovecot24-backend-pgsql / etc (openSUSE-SU-2026:21720-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21720-1 advisory. Update to 2.4.5. - CVE-2026-33263: submission-login: panic when mailmaxuseripconnections is reached bsc1276794. - CVE-2026-27852: DoS by sending...

PT-2026-85374

Name of the Vulnerable Software and Affected Versions IXON VPN Client versions prior to 1.4.7 Description An improper CRLF Carriage Return Line Feed sequence neutralization flaw allows unauthenticated local attackers to execute commands with root or SYSTEM privileges. The issue exists in a...

KLA91258 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability can be...

AlmaLinux 8 : gimp:2.8 (ALSA-2026:62507)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:62507 advisory. gimp: gimp: Stack buffer overflow in pnmscannergettoken CVE-2026-58380 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on...

Metabase 0.61.0 - Authenticated Remote Code Execution

Exploit Title: Metabase 0.61.0 - Authenticated Remote Code Execution Date: 2026-08-12 Exploit Author: Gutierre0x80 Vendor Homepage: https://www.metabase.com/ Software Link: https://github.com/metabase/metabase Version: = 0.58.0 = 0.59.0 = 0.60.0 = 0.61.0 Example: python3 exploit.py...

SonicWall SMA 1000 Series <= 12.4.3-03453 / 12.5.x <= 12.5.0-02835 Multiple Vulnerabilities (SNWLID-2026-0016)

The remote host is a SonicWall SMA 1000 Series device that is affected by multiple vulnerabilities: - A pre-authentication server-side request forgery SSRF vulnerability in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote, unauthenticated attacker...

Next.js Framework 13.4 < 15.5.24 / 16.x < 16.3.3 RCE (Windows)

The Next.js Framework on the remote host is affected by a remote code execution vulnerability: - A vulnerability in applications using both the Pages Router and App Router without Cache Components can lead to unauthenticated remote code execution when the Next.js server uses a Windows filesystem...

Microsoft Exchange Server MRSProxy Pre-Auth NTLM Relay RCE (CVE-2026-62911)

Binary data exchangecve-2026-62911.nbin...

Metabase 0.61.0 Remote Code Execution

Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned by native H2 queries in result columns of type OTHER without validation. An authenticated user with permission to execute native queries against an accessible H2...

Telerik UI for ASP.NET AJAX < 2026.3.812 Multiple Vulnerabilities

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.3.812. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may...

EUVD-2026-58518

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs...

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...

EUVD-2026-64016

Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE...

GHSA-JRRM-9HC7-2V3H Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Summary An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/sessionid/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By addin...

Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and...

GHSA-756X-9HF6-Q4H4 Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools

Summary An authenticated user can upload a crafted agent bundle that defines a server-side Python callable tool. The server validates the uploaded bundle, but it does not block dangerous callable: paths in untrusted user-provided agent configs. When the tool is invoked, the runner imports and...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-82524 UnoPim File Upload RCE via TinyMCE Image Upload Endpoint

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...

CVE-2026-84452 Windows ML CLI: CORS misconfig enables localhost RCE

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...