CVE-2026-52484

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

CVE-2026-92248: Integer Overflow or Wraparound

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

RockyLinux 10 : nginx (RLSA-2026:67314)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLin...

CVE-2026-88618

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...

nginx security update

1.26.3-6.0.1.el102.7 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.7 - Resolves: RHEL-212454 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 2:1.26.3-6.6 - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory...

CVE-2026-52484: Improper Neutralization of Special Elements used in an OS Command

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

PT-2026-95727

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp versions 1.0 through 1.52.4 Description A privilege escalation issue exists that allows local users with permission to create VPN connections to execute arbitrary code as root. An attacker can inject pppd options by using a...

EUVD-2026-78814

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...

CVE-2026-52484

An issue in MitraStar GPT-2742GX4X5v6-SV GLg2.5100XNT0b233 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

CVE-2026-88618

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code...

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components...

CVE-2026-91735: Incorrect Authorization

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-88618

The 1024-lab SmartAdmin v3.30.0 software is affected by a stored cross-site scripting (XSS) vulnerability within its file upload functionality . This flaw allows a remote attacker to achieve arbitrary code execution . No specific remediation, exploit links, or detailed technical root causes are p...

CVE-2026-91711: Out-of-bounds Write

Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-52484

The MitraStar GPT-2742GX4X5v6-SV router, running firmware GL_g2.5_100XNT0b23_3 , contains a command injection vulnerability in the /cgi-bin/device-management-utilities-internet.cgi component. An authenticated attacker can execute arbitrary code by bypassing special character filters using URL-enc...

PT-2026-116260

Уязвимость программного средства для взаимодействия с серверами cURL связана с использованием памяти после освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

CVE-2026-12354: Improper Control of Dynamically-Managed Code Resources

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code on the application server due to...

PT-2026-92170

An issue in MitraStar GPT-2742GX4X5v6-SV GL g2.5 100XNT0b23 3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component...

KLA91323 Multiple vulnerabilities in Oracle VirtualBox

Multiple vulnerabilities were found in Oracle VirtualBox. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Memory safety vulnerability can be exploit...

RHEL 9 : postgresql:16 (RHSA-2026:67491)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67491 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code executi...