CVE-2026-107508: Improper Limitation of a Pathname to a Restricted Directory

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...

Linux Distros Unpatched Vulnerability : CVE-2026-110777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file,...

Linux Distros Unpatched Vulnerability : CVE-2026-110152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandb...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: librsvg2 (UTSA-2026-130050)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130050 advisory. A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error ca...

Adobe Photoshop 26.x < 26.11.8 / 27.x < 27.11 Multiple Vulnerabilities (macOS APSB26-158)

The version of Adobe Photoshop installed on the remote macOS or Mac OS X host is prior to 26.11.8/27.11. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-158 advisory. - Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result i...

RHEL 9 : pcre2 (RHSA-2026:82845)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:82845 advisory. The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2026-130041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130041 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

Unity Linux 20.1070a Security Update: grafana-pcp (UTSA-2026-130157)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130157 advisory. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

Copeland XWEB and XWEB Pro Improper Limitation of a Pathname to a Restricted Directory (CVE-2026-22877)

An arbitrary file-read vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling unauthenticated attackers to read arbitrary files on the system, and potentially causing a denial-of-service attack. This plugin only works with Tenable.ot. Please visit...

RockyLinux 9 : libreoffice (RLSA-2026:82013)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:82013 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

CVE-2026-104103: Improper Limitation of a Pathname to a Restricted Directory

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

PT-2026-113659

The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to mark payment records as paid, destroy genuine payment...

PT-2026-113693

The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users...

CVE-2026-0315: Untrusted Search Path

A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on Linux, Windows,...

PT-2026-113895

Name of the Vulnerable Software and Affected Versions Junos OS on MX Series affected versions not specified Junos OS Evolved on PTX Series affected versions not specified Description A stack-based buffer overflow occurs in the cfmd process. This allows an unauthenticated attacker on the adjacent...

PT-2026-113652

Akamai GPA Guardicore Platform Agent client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in...

ROS-20261014-73-0200

The vulnerability in the kernel-lt is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

ROS-20261014-73-0112

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

VulnCheck KEV: CVE-2026-0322

A remote code execution RCE vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting acce...

VulnCheck KEV: CVE-2026-76519

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...