CVE-2026-108390

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-108151 WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through 1.3.9...

CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

CVE-2026-33798

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic...

CVE-2026-102055

A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent t...

CVE-2026-101955

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

EUVD-2026-101308

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

EUVD-2026-101416

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message...

CVE-2026-101981

A Stack-based Buffer Overflow vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . When LDP is enabled , an unauthenticated adjacent LDP peer can exploit this flaw by sending a malformed LDP Label Mapping message . This could result in an r...

EUVD-2026-101405

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic...

EUVD-2026-101388

A Stack-based Buffer Overflow vulnerability in the phone-home daemon phcd of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to execute arbitrary code as root via a crafted DHCP SZTP bootstrap message. This issue only affects platforms that support...

CVE-2026-101955 Junos OS: SRX Series: Malformed DNS packet causes service disruption when UTM Anti-Spam SBL is used

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

Important: Red Hat Security Advisory: pcre2 security update

An update for pcre2 is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

CVE-2026-92892

A flaw was found in JFrog CLI. Under specific configurations, a remote attacker can achieve arbitrary code execution on the host running the utility by exploiting improper command argument handling. Successful exploitation allows the attacker to run unauthorized commands within the context of the...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introduction In the ever-evolving landscape of cybersecurity, web applications remain a prime target for attackers seeking to exploit vulnerabilities. Recently, two critical vulnerabilities were discovered in the SourceCodester Simple Customer Relationship...

[SECURITY] [DSA 6560-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6560-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...

pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...