Element Labs LM Studio path traversal vulnerability

Element Labs LM Studio versions prior to 0.4.22+1 contain a path traversal vulnerability. This vulnerability stems from a path traversal flaw in the resolveDownloadRequest function within the model downloader. It allows attackers to write files outside the models directory by using backslashes to...

PT-2026-134481

Name of the Vulnerable Software and Affected Versions Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress versions prior to 1.2.0 Description Insufficient file path validation in the post delete assessment file by id function allows for arbitrary file deletion on the server...

PT-2026-133557

Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.8.0 Description An unauthenticated attacker with adjacent network access can exploit a missing authentication for critical function, leading to Server-side request forgery SSRF, which is a techniq...

PT-2026-134141

Summary On targets that do not have a conditional move/select operations, LLVM compiles the internal conditional sub u32 function, into one that will contain a conditional jump on secret-dependent data, which could leak information about encapsulation and signing keys. conditional sub u32 is used...

PT-2026-134414

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db values direct...

free5gc v4.2.3+ Root CA Private Key Exposure

free5gc versions v1.0.0 through v4.2.3+ contain a publicly committed Root CA private key that can be used to forge trusted network function certificates in deployments using its shipped TLS trust anchor. A proof of concept is provided. https://packetstorm.news/download/238561...

PT-2026-134217

In Trail of Bits fickling through 0.1.12, the process import method in fickle.py adds an imported name to the likely safe imports set whenever the source module is present in sys.stdlib module names and the name is absent from the UNSAFE IMPORTS denylist, without inspecting what the name resolves...

PT-2026-134478

Name of the Vulnerable Software and Affected Versions Uncanny Toolkit for LearnDash versions prior to 3.8.3 Description An authentication bypass exists due to a parser-differential flaw. The account-verification gate uses the raw email parameter passed to the uo login action function via get user...

PT-2026-133553

Name of the Vulnerable Software and Affected Versions AFFLIB versions prior to 3.7.23 Description A heap out-of-bounds write occurs in the af get page function. This happens when crafted AFF images are provided with mismatched page and sector sizes, specifically when the page size is larger than...

CVE-2026-119408: n8n-io n8n: n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via…

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden...

n8n permission and access control issue vulnerability

Versions prior to n8n 2.42.6, versions 2.43.x prior to 2.43.3, and versions 3.x prior to 3.0.1 contain a permission and access control vulnerability. This vulnerability arises because the deprecated Function, Function Item, and LangChain Code nodes run outside the isolation of the task runner...

PT-2026-134475

Name of the Vulnerable Software and Affected Versions Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker versions prior to 4.1.2 Description Unauthenticated attackers can achieve remote code execution on the server. The issue occurs because the id...

Juniper SSR < 7.0.5 / 7.1.x < 7.1.7 / 7.2.x < 7.2.3 Multiple Vulnerabilities (JSA112183)

The version of Juniper Session Smart Router SSR or Session Smart Conductor installed on the remote host is prior to 7.0.5, 7.1.x prior to 7.1.7, or 7.2.x prior to 7.2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the JSA112183 advisory. - An Improper Neutralization of...

Avada | Website Builder For WordPress & WooCommerce < 7.16.4 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field

Description The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded...

IBM MQ 9.4.0.0 < 9.4.0.30 LTS / 9.4.1.0 < 9.4.5.4 CD / 10.0.0.0 < 10.0.0.6 (7284695)

The version of IBM MQ Server running on the remote host is 9.4.0.0 through 9.4.0.26 LTS, 9.4.1.0 through 9.4.5.3 CD, or 10.0.0.0 through 10.0.0.5. It is, therefore, affected by a vulnerability as referenced in the 7284695 advisory. - IBM MQ could allow an authenticated attacker to cause a denial ...

CentOS Linux 7 [TuxCare] Security Update: dracut / dracut-caps / dracut-config-generic / dracut-config-rescue / etc (CENTOS7:CLSA-2026:1793090225)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793090225 advisory. - A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory...

Linux Distros Unpatched Vulnerability : CVE-2026-115456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in gcc. An attacker could cause a Denial of Service DoS by passing a string that is not null-terminated to the std::fromchars function in the...

Amazon Linux 2 : thunderbird (ALAS-2026-4057)

The version of thunderbird installed on the remote host is prior to 153.5.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4057 advisory. Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefo...

Important: thunderbird

Issue Overview: Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component...

SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24446-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24446-1 advisory. The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues: The following security issues were fixed: -...