PT-2026-128302

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

CVE-2026-117614: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to...

PT-2026-128322

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp...

PT-2026-129145

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the...

PT-2026-128316

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

CVE-2026-116778: Improper Neutralization of Special Elements used in an OS Command

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.2253 and 1.6.0-RC-1, an authenticated API-enabled user with uType=1 who possesses both the user's API token and the global FOG API token can use PUT /fog/storagenode/id/edit to modify Storage Node...

PT-2026-130590

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

Pillow TiffDecode Heap Buffer Overflow DoS

The vulnerability in the tiffWriteProc function within src/lib Imaging/TiffDecode.c of the Pillow image processing library is related to buffer overflows in memory during TIFF image processing. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service, disclose...

PT-2026-127808

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection...

PT-2026-128331

Ultralytics load dataset cache file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target...

PT-2026-127914

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special...

WordPress Affiliate Toolkit arbitrary file upload vulnerability

WordPress Affiliate Toolkit versions 3.9.2 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient validation of file types in the uploadimage function, weak checks on Content-Type prefixes, and the derivation of file extensions from URL paths...

Alma Linux: CVE-2026-93522: Important: xorg-x11-server-Xwayland security update (ALSA-2026-85193)

A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context...

Linux Distros Unpatched Vulnerability : CVE-2026-82389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfpagcreate in subsys/bluetooth/host/classic/hfpag.c starts an SDP discovery toward the peer,...

PT-2026-128326

Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this...

PT-2026-129093

Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys...

PT-2026-128330

Ultralytics parse model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or...

CVE-2026-118616: Improper Control of Generation of Code

Ultralytics parsemodel Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op...

PT-2026-129128

Name of the Vulnerable Software and Affected Versions Sophos UTM affected versions not specified Description A path traversal issue allows a remote unauthenticated attacker to execute arbitrary code as root. This occurs when the email proxy is used with scanning enabled and the attacker...

PT-2026-129157

MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check hash that silently returns True when hash val is None, with MD5 as the default hash type. Attackers performing man-in-the-middle or registry compromise can substitute bundles, datasets, or model archives...