CVE-2026-114630: elextensions ELEX WordPress HelpDesk & Customer Ticketing System: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

CVE-2026-111573: Checkmk GmbH Checkmk: Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the…

Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards the permission changes during service start, in Checkmk 2.5.0p18, 2.4.0p39, 2.3.0p52 and 2.2.0 EOL allow a local user to execute arbitrary code as SYSTEM by placing scripts in the agent's...

CVE-2026-123322: JetBrains WebStorm: In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI…

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader...

RHEL 8 : tesseract (RHSA-2026:95725)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:95725 advisory. A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNL...

RHEL 10 / 7 / 8 / 9 : Satellite 6 Client Update (Critical) (RHSA-2026:95653)

The remote Redhat Enterprise Linux 10 / 7 / 8 / 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:95653 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite Client. The updates address the vulnerability...

CVE-2026-123290: JetBrains Datalore: In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public…

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint...

CVE-2026-109883: Elementor Elementor Website Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5...

UBUNTU-CVE-2026-122328

SDLmixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw of src/decoderwav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion overwrites about 1 KB of adjacent stack memory, causing crashes o...

UBUNTU-CVE-2026-123151

A flaw was found in the GNU debugger GDB. When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with...

AJ-Report 1.7.1 Authentication Bypass / Remote Code Execution

AJ-Report through version 1.7.1 uses a hard-coded JWT secret for share tokens, allowing unauthenticated attackers to access the testTransform endpoint and execute Groovy code. This proof of concept demonstrates the issue. https://packetstorm.news/download/239794...

CVE-2026-82960

A flaw was found in Apache OFBiz. A remote authenticated attacker with Content Management System CMS editor permissions can exploit this code injection vulnerability to achieve arbitrary code execution on the underlying server. By submitting a crafted parameter in an HTTP request to the CMS...

CVE-2026-77604

A flaw was found in Code Graph RAG. When handling paginated file read requests, the application fails to properly validate and restrict file paths against the intended root directory. An unauthenticated attacker can exploit this vulnerability using absolute file paths or directory traversal...

CVE-2026-70659

A flaw was found in stable-diffusion.cpp. An attacker can trigger a heap-based buffer overflow by convincing a user to load a specially crafted importance matrix .imatrix file. Because the application reuses internal memory buffers without resizing them when encountering duplicate tensor entries,...

CVE-2026-120499

A flaw was found in h5io. This vulnerability allows an attacker to execute arbitrary code by convincing a user to process a specially crafted Hierarchical Data Format HDF5 file. During file parsing in the readhdf5 function, unsafe evaluation and deserialization of embedded objects enables...

CVE-2026-120438

A flaw was found in QuickJS-NG. This vulnerability allows an attacker executing JavaScript code to potentially achieve arbitrary code execution or cause a denial of service DoS through an application crash. The issue occurs due to an integer overflow during proxy property enumeration on 32-bit...

CVE-2026-120434

A flaw was found in Netpbm. An attacker could exploit this vulnerability to achieve arbitrary code execution or cause a Denial of Service DoS by crashing the application. The flaw occurs in the picttoppm converter when processing a specially crafted PICT image containing an excessive number of...

CVE-2026-123208

A flaw was found in noname. The Electron desktop application runs an unauthenticated local file server configured with overly permissive Cross-Origin Resource Sharing CORS settings. A remote attacker can exploit this flaw by tricking a user into visiting a malicious website that sends cross-origi...

CVE-2026-123095

A flaw was found in mpv. A remote attacker who controls a media feed or webpage can exploit this vulnerability by injecting newline characters into playlist URLs processed by the bundled ytdlhook script. This allows the attacker to bypass URL safety checks and load arbitrary local files or shared...

CVE-2026-123018

A flaw was found in DB-GPT. A remote attacker could exploit this vulnerability by submitting manipulated input to the executecode function within the CodeAction component. This flaw allows the attacker to execute arbitrary code on the underlying host system, potentially compromising the host...

CVE-2026-122014

A flaw was found in npcpy. An input validation vulnerability in the model loading component allows a remote attacker to execute arbitrary code. By supplying a specially crafted model name or path parameter, an attacker can inject and execute unintended commands within the application's runtime...