PT-2026-104592

LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their role to Superadmin or grant user.login as permissions to take over accounts an...

Debian dla-4816 : libpcre2-16-0 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4816 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4816-1 [email protected] https://www.debian.org/lts/security/...

PT-2026-104589

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

PT-2026-104475

Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.0 Description The software fails to block recipe files in the converters/calibre.ts component, passing them directly to the Calibre ebook-convert program. This allows the execution of arbitrary code contained...

PT-2026-104523

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description Insufficient sanitization of file paths within uploaded archives allows authenticated users with access to the asset-management feature to write arbitrary...

VulnCheck KEV: CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

Linux Distros Unpatched Vulnerability : CVE-2026-103622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-47573

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to...

Linux Distros Unpatched Vulnerability : CVE-2026-103626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potential...

Linux Distros Unpatched Vulnerability : CVE-2026-103630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-103623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-102991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath,...

CVE-2026-105115: Missing Authentication for Critical Function

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/ with an unverified session identifier and a chosen...

Linux Distros Unpatched Vulnerability : CVE-2026-103628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-103625

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Fedora 43 : unbound (2026-41f949afc4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-41f949afc4 advisory. Update to 1.26.1 rhbz2535076 Security fix list from upstream: - Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code Execution when...

CVE-2026-75028: Improper Control of Filename for Include/Require Statement in PHP Program

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-104851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0,...

FreePBX-CVE-2025-57819-CVE-2025-61678

FreePBX-CVE-2025-57819-CVE-2025-61678 CVE-2025-57819스택 쿼리 SQL 인젝션과 CVE-2025-61678FreePBX Endpoint Manager의 인증된 파일 업로드를 연쇄적으로 사용하여 원격 코드 실행RCE을 달성합니다. 교육 목적으로만 사용하십시오. 참조: https://www.picussecurity.com/resource/blog/critical-freepbx-vulnerabilities-cve-2025-66039-cve-2025-61675-cve-2025-61675...