CVE-2026-30631

An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 2025-09-11 allowing attackers to execute arbitrary code via crafted path to computerwritefile...

Oracle Linux 10 : nginx (ELSA-2026-36364)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-36364 advisory. - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-420...

PT-2026-61924

Name of the Vulnerable Software and Affected Versions Firefox version 152 Firefox ESR version 140.12 Thunderbird version 152 Thunderbird ESR version 140.12 Description Memory safety bugs were identified that showed evidence of memory corruption. These issues could potentially be exploited to...

Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

📄 WordPress Category Ajax Filter 2.8.2 Unauthenticated Local File Inclusion / Code Execution

WordPress Category Ajax Filter plugin version 2.8.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already...

hplip security update

3.23.12-10.5 - RHEL-192007 CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631 3.23.12-10.4 - Fix more leaks in hpcups 3.23.12-10.3 - OSH fixes after CVE-2026-8631 3.23.12-10.2 - CVE-2026-8631 hplip: Arbitrary code execution and privilege escalation via integer overflow in hpcups 3.23.12-10.1 ...

📄 WordPress YayExtra 1.3.6 Unauthenticated Shell Upload

WordPress YayExtra WooCommerce Extra Product Options plugin version 1.3.6 suffers from an unauthenticated shell upload vulnerability that achieves remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3 Explo...

📄 WordPress Copymatic 1.6 Unauthenticated Shell Upload

WordPress Copymatic plugin version 1.6 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the...

📄 WordPress Ajax Filter Posts (GridMaster) 3.4.11 Unauthenticated Local File Inclusion / Code Execution

WordPress Ajax Filter Posts GridMaster plugin version 3.4.11 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

KLA91163 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

WordPress Core Interpretation Conflict Vulnerability

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137...

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations...

DD-WRT Stack-Based Buffer Overflow Vulnerability

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability...

Security update for vim (important)

openSUSE security update: security update for vim ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21374-1 Rating: important References: bsc1271193 bsc1271194 bsc1271195 Cross-References: CVE-2026-59856 CVE-2026-59857 CVE-2026-59858 CVSS scores:...

PT-2026-61963

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a flaw that allows remote code execution, enabling an attacker to execute arbitrary code remotely with root privileges. The impact of this issue is reduce...

nginx security update

1.26.3-6.0.1.el102.5 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.5 - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer...

RHEL 8 : evince (RHSA-2026:42692)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:42692 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

PT-2026-62418

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the set ap param command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution...

Mozilla -- Memory safety bugs

https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/CVE-2026-16360 reports: Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been...

Linux Distros Unpatched Vulnerability : CVE-2026-63030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery...