CVE-2026-93352: Unrestricted Upload of File with Dangerous Type

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbiddenextensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via...

Linux Distros Unpatched Vulnerability : CVE-2026-91715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTM...

Linux Distros Unpatched Vulnerability : CVE-2026-91718

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-91710

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-91748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged...

Linux Distros Unpatched Vulnerability : CVE-2026-91728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-91745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-91734

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via...

Linux Distros Unpatched Vulnerability : CVE-2026-91729

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code...

CVE-2026-50228: Active Debug Code

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...

CVE-2026-84474: Reliance on Untrusted Inputs in a Security Decision

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret hostconfigkey is exposed to users holding only the read-level viewjobtemplate permission -- both in the job template API representation and in the activity stream -- and the...

MiracleLinux 8 : libtiff-4.0.9-39.el8_10 (AXSA:2026-1889:10)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1889:10 advisory. libtiff: libtiff: Arbitrary code execution via processcommandopts function CVE-2026-52490 Tenable has extracted the preceding description block directly from...

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, allows attackers to execute arbitrary code.

The vulnerability of the SAP Message Server, a software integration platform of SAP NetWeaver, is related to the use of single-factor authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

RHEL 9 : vim (RHSA-2026:70818)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:70818 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary Code Execution via crafted directo...

CVE-2026-96804: Deserialization of Untrusted Data

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOWALLOWPICKLEDESERIALIZATION=False security control entirely in loadmodel, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

Linux Distros Unpatched Vulnerability : CVE-2026-91738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox v...

Linux Distros Unpatched Vulnerability : CVE-2026-91018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

The vulnerability of the printing control software in PaperCut MF and PaperCut NG, related to insecure dynamic class loading, allows a violator to execute arbitrary code.

The vulnerability of printing control software in PaperCut MF and PaperCut NG lies in the unsafe dynamic loading of classes, due to the lack of checks to ensure that the loaded classes comply with the list of allowed drivers. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2025-63564

The Moodle Socialwall plugin versions v.3.0 through v.3.3 are affected by a SQL injection vulnerability. An attacker can exploit this flaw by sending crafted HTTP requests , which may lead to the execution of arbitrary code . The vulnerability is classified with a CRITICAL base severity score of ...

CVE-2026-79310

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI) . The vulnerability exists because the template engine can be manipulated into executing attacker-controlled code that bypasses built-in security checks. Specifically, if an application precompiles templates from a directory...