CVE-2026-88392

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-12171: Inclusion of Functionality from Untrusted Control Sphere

auto-changelog before 2.6.1 merges configuration from inside the target repository the .auto-changelog file and the auto-changelog key in package.json into its options, and honors security-sensitive options from that untrusted source. The handlebarsSetup option is passed to require, so running...

CVE-2026-104809: External Control of File Name or Path

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...

ROS-20261005-73-0095

The vulnerability in dotnet9.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Ad Adobe Campaign Classic Code Execution

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Ad Adobe Campaign Classic Code Execution

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Ad Adobe Campaign Classic Code Execution

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

Adobe Campaign Classic Code Execution

The vulnerability of the Adobe Campaign Classic software platform for conducting marketing campaigns is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Adobe Substance 3D Modeler Buffer Overflow RCE

The vulnerability of the Adobe Substance 3D Modeler software-related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2026-105677: Improper Limitation of a Pathname to a Restricted Directory

Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...

AlmaLinux 9.2 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1791208722)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791208722 advisory. - Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer proce...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

AlmaLinux 10 : osbuild-composer (ALSA-2026:66432)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66432 advisory. golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821...

CVE-2026-78861: Memory Allocation with Excessive Size Value

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-101919: Improper Input Validation

A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...

CVE-2026-37719: Deserialization of Untrusted Data

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

PT-2026-104818

Name of the Vulnerable Software and Affected Versions LibreOffice Calc versions prior to 26.2.5 Description LibreOffice Calc allows linking a cell range to an external data source, with the link saved within the document. An attacker can specify a Java database driver to be loaded from a remote...

PT-2026-105997

Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

PT-2026-106242

Name of the Vulnerable Software and Affected Versions AMD Versal™ Adaptive SoC affected versions not specified Description Insufficient boundary checks in USB boot mode, when enabled via board modifications, allow the use of crafted images to trigger a buffer overflow. This can overwrite an activ...