Siemens Software Center < 4.0.9.8 DLL Sideloading (SSA-580366)

The version of Siemens Software Center installed on the remote Windows host is prior to 4.0.9.8. It is, therefore, affected by a vulnerability as referenced in the SSA-580366 advisory. - A vulnerability has been identified in Siemens Software Center All versions V4.0.9.8. The affected application...

Important: dotnet8.0

Issue Overview: Improper control of generation of code 'code injection' in ASP.NET Core allows an unauthorized attacker to execute code over a network. CVE-2026-102870 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

Important: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

CVE-2026-37468: n/a: Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary…

Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component...

Rocky Linux 9.6 [TuxCare] Security Update: bluez / bluez-cups / bluez-hid2hci / bluez-libs / bluez-libs-devel / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793354956)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793354956 advisory. - BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers...

CVE-2026-37468

Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : .NET vulnerabilities (USN-8958-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8958-1 advisory. It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could...

PT-2026-133516

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 25.1.1.3 Ivanti Connect Secure versions prior to 22.8R2.6 Description The software uses predictable filenames, which allows a remote authenticated attacker to upload files containing controlled content t...

PT-2026-133759

Name of the Vulnerable Software and Affected Versions Widget Options versions 4.2.5 and earlier Description An attacker with access to the plugin can execute arbitrary code on the web server hosting the site through the widget settings. Recommendations At the moment, there is no information about...

CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convertpaletteimagestotruecolor function. This is due to insufficient file type validation before processing uploaded files. This mak...

PT-2026-133672

Name of the Vulnerable Software and Affected Versions aws-nitro-enclaves-sdk-c versions prior to 0.4.6 Description A use-after-free and double-free issue exists in the SetClient command handler of the kmstool-enclave sample application. This flaw allows an application running on the parent EC2...

CVE-2026-116852: Marketing Fire Widget Options: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.

Author Remote Code Execution RCE in Widget Options = 4.2.5 versions...

CVE-2026-119262: Google Chrome: Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially…

Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Joomla Content Editor 2.9.99.4 Unauthenticated Remote Code Execution

Joomla Content Editor versions through 2.9.99.4 contain an improper access control vulnerability in profile import functionality that allows unauthenticated attackers to upload PHP files and execute code. https://packetstorm.news/download/238566...

PT-2026-134442

Name of the Vulnerable Software and Affected Versions PDF Invoice for WooCommerce + Drag and Drop Template Builder versions prior to 7.1.2 Description PHP Object Injection occurs due to insufficient sanitization of the customer note parameter. The input is inlined into invoice HTML, entity-decode...

CVE-2026-114422: Unknown Enable Media Replace: The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored…

The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that is instantiated when a user with upload access performs a...

PT-2026-134238

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit Headers"Accept: ", "Content-Type: " attribute string without escaping quotation marks. A crafted...

CVE-2026-63344: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit library

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit Headers"Accept: ", "Content-Type: " attribute string without escaping quotation marks. A crafted...

CVE-2026-116243: pgadmin.org pgAdmin 4: pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...