CVE-2026-88618

The 1024-lab SmartAdmin v3.30.0 software is affected by a stored cross-site scripting (XSS) vulnerability within its file upload functionality . This flaw allows a remote attacker to achieve arbitrary code execution . No specific remediation, exploit links, or detailed technical root causes are p...

PT-2026-91930

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencie...

CVE-2026-88618

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

PT-2026-95727

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp versions 1.0 through 1.52.4 Description A privilege escalation issue exists that allows local users with permission to create VPN connections to execute arbitrary code as root. An attacker can inject pppd options by using a...

CVE-2026-61668: Improper Certificate Validation

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl.createunverifiedcontext to download the second-stage pilot.tar archive without TLS certificat...

nginx security update

1.26.3-6.0.1.el102.7 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.7 - Resolves: RHEL-212454 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 2:1.26.3-6.6 - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory...

RHEL 9 : postgresql:16 (RHSA-2026:67491)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67491 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...

CVE-2026-12728: Deserialization of Untrusted Data

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted...

CVE-2026-91734: Incorrect Authorization

Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...

CVE-2026-91735: Incorrect Authorization

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

RockyLinux 9 : postgresql:16 (RLSA-2026:67491)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67491 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitra...

PT-2026-93111

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...

AlmaLinux 10 : nginx (ALSA-2026:67314)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

RockyLinux 10 : nginx (RLSA-2026:67314)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLin...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Malicious code in get-power (npm)

Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while mirroring get-proto's file layout as cover. On require, index.j...

CVE-2026-12944

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

CVE-2026-67399

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code...

CVE-2026-65414

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A remote attacker may be able to cause unexpected app...