CVE-2026-101169: Deserialization of Untrusted Data

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

PT-2026-102493

Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.07 Description When configured with the CONFIG IP DEFRAG=y parameter, the software fails to clear the IP reassembly state after delivering a complete datagram. This allows an attacker capable of delivering...

CVE-2026-103041: Deserialization of Untrusted Data

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

CVE-2026-102327: Incorrect Authorization

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-102566: Out-of-bounds Write

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

ROS-20260929-73-0036

The vulnerability of the dwc3removerequests function in Linux operating system kernels is related to the situation of signal handling. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

EUVD-2024-55777

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95298): chromium -- security fixes

Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

CVE-2026-76732: Improper Privilege Management

A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the...

CVE-2024-31027: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

CVE-2026-84421: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

PT-2026-102798

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

PT-2026-102456

Name of the Vulnerable Software and Affected Versions GEOVIA Geospatial Data Manager versions R2024x through R2026x Description A code injection flaw allows an attacker to execute arbitrary code on the server. Code injection is a type of attack where an attacker introduces malicious code into a...

CVE-2026-76721: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

EUVD-2026-89423

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

PT-2026-102883

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2026-79403

Versions of Kilo Code prior to v7.4.1 are vulnerable to an issue that allows a local attacker to achieve arbitrary code execution . The vulnerability is accessible via the permission/allow-everything endpoint. While the technical root cause is not explicitly detailed in the provided documents, th...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

ruby:3.3 security update

ruby 3.3.12-9 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252039 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 3.3.10-7 - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181693 - Fix...

CVE-2026-95349: Heap-based Buffer Overflow

Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...