PT-2026-61923

Name of the Vulnerable Software and Affected Versions Firefox version 152 Thunderbird version 152 Description Memory safety bugs were identified that showed evidence of memory corruption. These issues could potentially be exploited to execute arbitrary code. Recommendations Update Firefox to...

PT-2026-63250

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description An inappropriate implementation in the WebAudio component allows a remote attacker to execute arbitrary code within a sandbox by enticing a user to visit a specially crafted HTML page...

PT-2026-62073

Name of the Vulnerable Software and Affected Versions bytebot-ai affected versions not specified Description An issue allows attackers to execute arbitrary code by providing a crafted path to the computer write file function. Recommendations At the moment, there is no information about a newer...

PT-2026-61970

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a privilege escalation flaw that allows a group to elevate its access to system administrator levels. This can lead to arbitrary code execution with root...

PT-2026-61964

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61962

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description An insecure direct object reference IDOR issue allows an attacker with group administrator access to achieve privilege escalation and remote code execution as root. IDOR is a type o...

PT-2026-62038

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authenticated path traversal vulnerability exists in AOS-CX. This issue allows an attacker to copy arbitrary files to a user-readable location via the command line interface of the underlyi...

PT-2026-63247

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description A stack buffer overflow exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by the browser. This flaw allows a remote attacker to execute arbitrary...

PT-2026-63585

Name of the Vulnerable Software and Affected Versions fastjson versions 1.2.68 through 1.2.83 Description A remote code execution RCE issue exists in the fastjson library, specifically impacting Spring Boot applications. This flaw allows an unauthenticated attacker to execute arbitrary code with...

📄 WordPress Royal Elementor Addons 1.3.78 Unauthenticated Shell Upload

WordPress Royal Elementor Addons plugin version 1.3.78 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request fl...

PT-2026-62084

Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code. This is achieved by manipulating the mcp parameter. Recommendations At the moment, there is no...

CVE-2026-50757

Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server...

Linux Distros Unpatched Vulnerability : CVE-2026-63030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

PT-2026-61967

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-62083

Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A Directory Traversal issue exists in the nex-ai-draw-io/mcp-server component. This flaw allows a remote attacker to execute arbitrary code by traversing directories to access or manipulat...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

CVE-2026-30631

An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 2025-09-11 allowing attackers to execute arbitrary code via crafted path to computerwritefile...

Amazon Linux 2 : libtiff, --advisory ALAS2-2026-3823 (ALAS-2026-3823)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3823 advisory. A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compress...

PT-2026-61819

Name of the Vulnerable Software and Affected Versions TeX Live affected versions not specified GNOME Evince affected versions not specified Description The SyncTeX parser synctex parser.c contains a heap use-after-free issue. This occurs when a malformed .synctex or .synctex.gz file constructs a...