Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

PT-2026-102740

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

PT-2026-102459

Name of the Vulnerable Software and Affected Versions Apache Karaf versions prior to 4.4.12 Apache Karaf versions prior to 4.5.0 Description Apache Karaf contains a flaw in the KarafMBeanServerGuard which fails to enforce role-based access control RBAC on specific MBean lifecycle operations. The...

CVE-2026-95339: Use After Free

Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

ROS-20260929-73-0036

The vulnerability of the dwc3removerequests function in Linux operating system kernels is related to the situation of signal handling. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2024-31027

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

PT-2026-102936

Name of the Vulnerable Software and Affected Versions LightLLM versions prior to 1.2.1 Description Multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. This allows attackers to send crafted serialized objects to exposed cache...

CVE-2026-103041: Deserialization of Untrusted Data

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

Important: gvfs

Issue Overview: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buff...

PT-2026-102860

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the...

RockyLinux 10 : ipa (RLSA-2026:72279)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:72279 advisory. ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in...

PT-2026-102543

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102604

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists in the DOM: UI Events & Focus Handling component. A use-after-free is a memory corruption flaw that...

PT-2026-102546

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 140.17 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the DOM: Core & HTML component. A use-after-free occurs...

PT-2026-102913

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

PT-2026-102456

Name of the Vulnerable Software and Affected Versions GEOVIA Geospatial Data Manager versions R2024x through R2026x Description A code injection flaw allows an attacker to execute arbitrary code on the server. Code injection is a type of attack where an attacker introduces malicious code into a...

PT-2026-102883

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2026-79403

Versions of Kilo Code prior to v7.4.1 are vulnerable to an issue that allows a local attacker to achieve arbitrary code execution . The vulnerability is accessible via the permission/allow-everything endpoint. While the technical root cause is not explicitly detailed in the provided documents, th...

CVE-2026-79403: Improper Handling of Insufficient Permissions or Privileges

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

Ubuntu 18.04 LTS / 24.04 LTS : dracut vulnerabilities (USN-8828-1)

The remote Ubuntu 18.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8828-1 advisory. It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could...