PT-2026-135502

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

libXi security update

1.7.10-8.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293452 1.7.10-8.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293398...

libXi security update

1.8.1-7.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293447 1.8.1-7.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293391...

PT-2026-135356

Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability...

ALSA-2026:93438 Important: libXi security update

X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow CVE-2026-109089 For more details about the security issues, including the...

CVE-2026-119735: Petpooja Munshi: Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated…

Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...

ALSA-2026:93439 Important: libXi security update

X.Org X11 libXi runtime library Security Fixes: libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply CVE-2026-109090 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow CVE-2026-109089 For more details about the security issues, including the...

PT-2026-135827

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 260928 Description Authenticated attackers with custom-level access and above can achieve remote code execution on the server. The issue exists in the IPN email template handling due to insufficient sanitization in t...

CVE-2026-55261: Google Android: In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing…

In nfat4tnfceestorerxbuf of nfanfceeact.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58876: Google Android: In multiple locations, there is a possible memory safety issue due to a use-after-free

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-135283

In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545...

PT-2026-135419

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution...

PT-2026-135491

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16 Description An OS command injection flaw exists in the protected directory user panel module. The issue occurs when unescaped input is submitted through the file POST parameter in the acc=deletedp actio...

CVE-2026-120433: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100 points to overwrite the fixed pts array...

CVE-2026-120435: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm…

Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greater than 3 to overrun fixed 3-byte...

CVE-2026-116958: A flaw was found in konflux-ci

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

PT-2026-135711

In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-73696: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user…

Control Web Panel CWP before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow CWPUserIndex that allows unauthenticated attackers to bypass authentication by exploiting a missing exit call after a header'Location: ...' redirect. Attacker...

PT-2026-135805

The vulnerability is a Use-After-Free UAF in the EVS AIDL HAL, arising from a data race on an unsynchronized std::weak ptr within EvsEnumerator::openCamera. Specifically, concurrent calls from a privileged UID e.g., AID AUTOMOTIVE EVS can cause a torn weak ptr state, leading to a virtual call...

CVE-2026-120451: gPhoto libgphoto2: libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that…

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005cinit that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more...