CVE-2026-47168: Deserialization of Untrusted Data

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object data that is stored in background MassAction or Export parameters and later deserialized by the application. The deserialization paths do...

CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

Cisco Secure Email Gateway 16.0 AMP Arbitrary File Write

Cisco Secure Email Gateway versions 13.0 through 16.0 prior to Content Scanner Tools package 25.3.0.5525 contain a relative path traversal vulnerability in AMP File Reputation attachment handling that allows unauthenticated arbitrary file write...

PT-2026-115315

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.84 Description Memory corruption in Workers allows a remote attacker to potentially execute arbitrary code inside the sandbox when a user opens a crafted HTML page. Recommendations Update Google Chrom...

PT-2026-115218

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions prior to 26.2.3 Description Internal messaging components of the product fail to adequately validate the origin of received messages. This improper origin validation allows an unauthenticated remote attacker...

PT-2026-114926

Name of the Vulnerable Software and Affected Versions Enterprise Architect version 17.1 Description The XSLT Debugger feature allows XML External Entity XXE injection. This occurs when the parser processes a crafted XML file containing a DOCTYPE with an external DTD reference, enabling an attacke...

UBUNTU-CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

VulnCheck KEV: CVE-2026-59774

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files...

GitLab 19.2 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-97229)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an...

CVE-2026-110734

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR .hdr image decoder modules/hdr/imageloaderhdr.cpp. The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gvfs (UTSA-2026-130161)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130161 advisory. A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds...

PT-2026-114931

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, grid obj open in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitra...

CVE-2026-104024: Incomplete List of Disallowed Inputs

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-110859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch...

MiracleLinux 9 : dovecot-2.3.16-18.el9_8.8 (AXSA:2026-2051:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2051:08 advisory. dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters CVE-2026-42391 dovecot: Dovecot: Authentication bypass via incorre...

MiracleLinux 9 : flatpak-1.12.9-4.el9_8.4 (AXSA:2026-2050:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2050:04 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via...

Ivanti Connect Secure Authentication Bypass Code Execution

The vulnerability of the Ivanti Connect Secure network access control tool relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms and execute arbitrary code...

CVE-2026-110163

Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-102734

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with numpy enabled exposes a ctypes type and permits fromaddress memory access. safegetattr blocks the ctypes module but not reachable ctypes type objects,...

CVE-2026-110144

Incorrect authorization in Mojo in Google Chrome on on Windows prior to 155.0.8059.79 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: High...