CVE-2026-84568: Improper Limitation of a Pathname to a Restricted Directory

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-43692: Improper Input Validation

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution...

CVE-2026-13293: Deserialization of Untrusted Data

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote authenticated attacker to execute arbitrary code on the system due to the...

CVE-2026-82770: Buffer Copy without Checking Size of Input

Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request to the product's web service, an arbitrary program may be executed...

CVE-2026-90947: Out-of-bounds Write

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicio...

PT-2026-91835

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...

CVE-2026-82793: Unrestricted Upload of File with Dangerous Type

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product...

CVE-2023-50461: Incorrect Authorization

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

CVE-2026-25687: Race Condition within a Thread

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

Checkov Code Analysis Code Execution

The vulnerability of the Checkov code analysis tool by Prisma Cloud lies in the inclusion of functions from an unverified controlled area. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code...

CVE-2026-90949: Out-of-bounds Write

A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting...

PT-2026-117974

Name of the Vulnerable Software and Affected Versions Safari versions prior to 27 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 visionOS versions prior to 27 Description A type confusion issue exists due to improper state management. Processing...

anki -- multiple vulnerabilities

Abdo Hasani reports: Imported note HTML may execute inside an embedded image-occlusion document that retains the editor profile's desktop API credentials. This could cross the boundary between untrusted note content and privileged desktop operations. An improper path validation vulnerability allo...

Linux Distros Unpatched Vulnerability : CVE-2026-90949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a...

CVE-2026-61701: Deserialization of Untrusted Data

Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...

Important: libtiff

Issue Overview: An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.12.20260914 or dnf...

CVE-2026-84506: Use After Free

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to execute arbitrary code with kernel privileges...

PT-2026-117972

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 visionOS versions prio...

Adobe Experience Manager Auth Bypass RCE

The vulnerability of the Adobe Experience Manager content and media management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:4095-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4095-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...