Ultralytics deserialization injection vulnerability

Version 8.4.65 of Ultralytics contains a deserialization injection vulnerability. This flaw stems from improper validation of user-supplied data by the torchload function, allowing untrusted data to be deserialized. As a result, remote attackers can execute arbitrary code under the current user’s...

PT-2026-128134

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print graph function event tracing set tracer assigns the flags of the newly selected tracer with: tr-current trace flags = t-flags ? : t-tracer-flags; If the new tracer defines neither static flags nor...

CVE-2026-116613: bplugins Animated Text Block – Add Typing and Looping Text Effects: The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and…

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atbshortcodehandler function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch,...

PT-2026-129221

A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be...

Linux Distros Unpatched Vulnerability : CVE-2026-118375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdmarecv function that allows unauthenticated peers t...

CVE-2026-118578: maotoumao MusicFreeDesktop: A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8

A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146616)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146616 advisory. In the Linux kernel, the following vulnerability has been resolved: fbdev: uvesafb: unregister connector callback on init failure uvesafbinit registers the v86d...

CVE-2026-118614: Improper Control of Generation of Code

Ultralytics checkdetdataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page ...

PT-2026-128166

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.161 Linux kernel versions prior to 6.11 Description A use-after-free issue exists in the tracefs eventfs revalidation process. A local user can trigger reads of freed kernel memory by racing path lookups with...

CVE-2026-118272: a2ui-project a2ui: A vulnerability was detected in a2ui-project a2ui up to 0.10.6

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

Jeremy Kahn Chitchatter authorization issue vulnerability

There is an authorization issue vulnerability in Jeremy Kahn Chitchatter. It stems from improper handling of the parentDomain parameter in the isConfigMessageEvent function within the src/Bootstrap.tsx file in the PostMessage Handler component. This leads to improper authentication and may be...

A2UI resource management error vulnerability

Versions A2UI 0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, and 0.10.6 contain a resource management error vulnerability. This vulnerability arises from the Parser component’s interaction with the formatString function in the file...

CVE-2026-99186

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

PT-2026-128323

Alpine iLX-F511 libanwbtstack.so prh rfcomm cc process test Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the abili...

WordPress Affiliate Toolkit arbitrary file upload vulnerability

WordPress Affiliate Toolkit versions 3.9.2 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient validation of file types in the uploadimage function, weak checks on Content-Type prefixes, and the derivation of file extensions from URL paths...

CVE-2026-118538: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.12.0

A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes. The attack may be launched remotely...

CVE-2026-118615: Improper Neutralization of Special Elements used in an OS Command

Ultralytics torchsafeload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-110181: Protection Mechanism Failure

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the...

CVE-2026-107745: tigroumeow: The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file…

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

PT-2026-127800

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like...