Apache S2-032 Struts - Remote Code Execution

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix related to chained expressions. id: CVE-2016-3081 info: name: Apache S2-032 Struts - Remote Code Execution...

Likeshop < 2.5.7.20210311 - Arbitrary File Upload

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file with an...

EUVD-2026-112505

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...

EUVD-2026-112489

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a...

PT-2026-132858

NØØT Security Alerts 🚨 ALERT — Delinea Privilege Manager Windows Agent Remote Code Execution October 29, 2026 PRODUCT: Delinea Privilege Manager cloud and on-prem Windows agents. CVE: CVE-2026-92744 | SEVERITY: HIGH CVSS 4.0: 8.7. AFFECTED: 10.1.0–12.0.5796 and 13.0.0–13.0.1058. IMPACT: Under...

CVE-2026-92744: Delinea Privilege Manager: Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as…

Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem...

CVE-2026-85890: Microsoft Microsoft Edge (Chromium-based): Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Double free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-113265

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request...

CVE-2026-107057

An issue in AndBible (version 1111 ) allows an attacker to achieve arbitrary code execution by uploading a crafted module zip file. No specific remediation, exploit links, or technical root cause details are provided in the documents.

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nginx (UTSA-2026-146980)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146980 advisory. NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain configurations, processin...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

MiracleLinux 8 : flute, libbase, libfonts, libformula, liblayout, libloader, libreoffice, librepository, libserializer, pentaho-libxml, pentaho-reporting-flow-engine, and sac (AXSA:2026-2174:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2174:01 advisory. libreoffice: heap buffer overflow in PDF import stream handling CVE-2026-63274 libreoffice: stack buffer overflow in CFF to Type 1 font conversion...

CVE-2026-107050

An issue in libretro RetroArch v1.22.2 allows an attacker to force another user to load attacker-supplied code within their own uid . This vulnerability can lead to arbitrary code execution . The provided documents do not specify the exact technical root cause, practical remediation, or known exp...

EUVD-2026-113263

An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution...

Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-3342)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3342 advisory. Fix GHSA-66mr-7wc7-23vc: FreeRDP client can abort while logging a malformed RDPDR device announcement Fix GHSA-x7w3-32ch-x2jq: winpr image conversion: heap over-read encoding 16 bpp DIBs to PN...

KLA91383 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in MediaStream can be exploited remotely to execute...

CVE-2026-115943: Eval Injection

Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as 100, ExcelFmt chooses the format section by passing the condition and the cell value to a string eval. Both come from the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nginx (UTSA-2026-146978)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146978 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's...

bind security update

9.18.33-15.0.1.el102.14 - Hard require needed openssl-libs Orabug: 38742109 - Fix warning when changing device file permissions Orabug: 36518580 32:9.18.33-15.14 - Prevent arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-94300 - Fix Denial of service via assertion failure in RPZ...

Oracle Linux 10 : bind (ELSA-2026-92419)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-92419 advisory. - Prevent arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-94300 - Fix Denial of service via assertion failure in RPZ query processi...