PT-2026-134243

Name of the Vulnerable Software and Affected Versions OpenSearch versions 2.8.0.0 through 2.19.6.0 OpenSearch versions prior to 3.7.0.0 Description A remote authenticated user with basic read/search permissions can trigger unsafe deserialization of untrusted data by providing a crafted cursor...

CVE-2026-104067: Scribus: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify…

Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code...

CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1...

CVE-2026-61708: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agentdatastore/upload in backend/app/datastore/datastoreroutes.py permits customeruser callers to choose bucketname and objectname without an allowlist, tenant prefix...

CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, wi...

CVE-2026-84243: The GNU C Library glibc: The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries…

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

PT-2026-133732

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.0 and later Description The gettext family of functions allows the LANGUAGE environment variable to contain entries with '/' or '..', provided the program is not running as setuid or setgid AT SECURE. An attacker capab...

CVE-2026-63393: opensearch-project sql: OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoi...

PT-2026-133653

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb data vertical flip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write...

CVE-2026-119722: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that…

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in readstruct that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer...

CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /updateweights endpoint. Attackers can submit a base64-encoded crafted pickle in serializednamedtensors, which...

CVE-2026-16760: trailofbits fickling: In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the…

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...

PT-2026-133465

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.42.6 n8n versions 2.43.x prior to 2.43.3 n8n versions 3.x prior to 3.0.1 Description Authenticated users with permissions to create, modify, or import workflows can execute JavaScript within the main process. This occur...

ALSA-2026:93072 Important: bind9.18 security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

Important: edk2

Issue Overview: EDK2 contains a vulnerability in BIOS where a user may cause "Out-of-bounds Write", Classic Buffer Overflow, and "Incorrect Calculation of Buffer Size" by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact...

Linux Distros Unpatched Vulnerability : CVE-2026-119261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox vi...

VulnCheck KEV: CVE-2026-119977

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window...

Linux Distros Unpatched Vulnerability : CVE-2026-119777

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing...

PT-2026-133735

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.1.4 WordPress versions prior to 7.0.8 WordPress versions prior to 6.9.11 WordPress versions prior to 4.7.39 Description A remote code execution issue exists during the core upgrade process. When a full upgrade...

RHEL 7 : httpd (RHSA-2026:92590)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92590 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...