PT-2026-65784

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco save settings function, which allows...

PT-2026-65705

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

ALSA-2026:47982 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Denial of Service via stack out-of-bounds write in spellsoundfoldsofo CVE-2026-57455 vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-57456 vim: Vim:...

PT-2026-65896

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The image.download and related file-writing modules use a caller-controlled output dir instead of the validate path with env config function and its FLYTO SANDBOX DIR confinement. This allows...

PT-2026-65704

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

PT-2026-65883

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected...

PT-2026-65691

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

PT-2026-65885

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

RockyLinux 10 : pipewire (RLSA-2026:47083)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47083 advisory. pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading CVE-2026-5674 Tenable has extracted the preceding description bloc...

PT-2026-65777

GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A grammar file can override the executable used for the XML‑to‑HTML transformation step via %define tool.xsltproc, which is accepted without...

Linux Distros Unpatched Vulnerability : CVE-2026-56389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Bison allows for an execution of an arbitrary program during HTML report generation due to improper handling of grammar-defined configuration variables. A...

PT-2026-65944

Pwn2Own Sony XAV-9500ES gpsd Buffer Overflow Arbitrary Code Execution Vulnerability...

PT-2026-65874

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...

CVE-2026-54658 @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue in packages/clickhouse/src/core/utils.ts did not escape backslashes before single quotes during parameter substitution, allowing attacker controlled query parameters with a trailing backslash to escape the closin...

CVE-2026-55390

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

CVE-2026-55389 datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the validators processing in the --extra-template-data file. An attacker can execute arbitrary code during module import by supplying specially crafted...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the x-python-type extension in JSON Schema processing. An attacker can execute arbitrary code by supplying a crafted JSON Schema that injects malicious...

GHSA-442Q-2J6P-642G datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Summary When generating models from an XML Schema --input-file-type xmlschema, datamodel-code-generator resolves , , , and schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read...