EUVD-2026-60509

An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to arbitrary code execution...

EUVD-2026-60552

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code...

PT-2026-77144

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controll...

The vulnerability of the standard authentication client of the Data Hub Adapter for the SAP Commerce Cloud platform allows a hacker to execute arbitrary code and cause complete system compromise.

The vulnerability of the standard authentication client for Data Hub Adapters in the SAP Commerce Cloud platform is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, leading to a complete compromise of the system...

PT-2026-77334

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by the browser. This flaw allows a remote attacker to execute arbitrary...

PT-2026-77325

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description Type confusion in the V8 engine allows a remote attacker to execute arbitrary code within the sandbox by using a specially crafted HTML page. Type confusion is a logic error where the...

PT-2026-77137

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description The Git node clone operation allows an authenticated workflow user to replace a validated directory with a symlink before the cloning process...

CVE-2026-30250

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

Broadcom VMware vCenter Path Traversal Vulnerability

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code...

PT-2026-77162

CodeWhale versions before 0.8.64 fail to properly validate the allow shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the...

CVE-2026-67921

Halo CMS (versions up to 2.25.4 ) is affected by a CSRF/CORS misconfiguration in CorsConfigurer.java and CsrfConfigurer.java. The console API does not validate XSRF tokens, the session cookie uses SameSite=None, and CORS reflects any origin with credentials. This enables a browser-based attack ch...

CVE-2026-30250

A stored cross-site scripting flaw in the user documentation field of Beta Systems ANOW! Automate v3.3.1.90 allows an unauthenticated remote attacker to inject arbitrary script (CVSS 6.1, MEDIUM). CISA flags it as a PoC-level issue; no patch version or mitigation is provided in the documents.

CVE-2026-67920

Halo 2.25.4's MigrationServiceImpl.restoreWorkdir() fetches an arbitrary URL, extracts the zip's workdir/ into the Halo work dir unsanitized via FileSystemUtils.copyRecursively(), replacing the entire extension store and enabling RCE. A working exploit (exploit/migration_restore.py) is verified a...

PT-2026-77322

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An inappropriate implementation in the Media component of Google Chrome on Mac allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by inducing the...

PT-2026-77333

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.169 Description A buffer overflow exists in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on non-native platforms. This issue allows a remote attacker who has already...

PT-2026-77324

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A link following issue exists in the CredentialProvider component on Windows. This flaw allows a local attacker to potentially execute arbitrary code outside the sandbox by utilizing a...

PT-2026-77323

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.169 Description A buffer overflow exists in Dawn, which allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a specially crafted HTML page. A...

PT-2026-77142

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH DOTENV FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the...

RHEL 8 : kernel (RHSA-2026:55764)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55764 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm/slub: avoid accessing...

VMware vCenter Server 8.0 < 8.0 U3k / 9.0.x < 9.0.2.0100 / 9.1.x < 9.1.0.0300 Directory Traversal (VMSA-2026-0006)

The version of VMware vCenter Server installed on the remote host is 8.0 prior to 8.0 Update 3k, or 9.0.x prior to 9.0.2.0100, or 9.1.x prior to 9.1.0.0300. It is, therefore, affected by a vulnerability as referenced in the VMSA-2026-0006.1 advisory: - VMware vCenter contains a directory traversa...