PT-2026-134194

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-3374)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3374 advisory. Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally. CVE-2026-114148 Out-of-bounds write in .NET allows an unauthorized attacker to execut...

AlmaLinux 9.2 [TuxCare] Security Update: ansible-core / ansible-test (ALMALINUX9.2:CLSA-2026:1793373763)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793373763 advisory. - A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone...

RHEL 9 : Satellite 6.19 (RHSA-2026:92861)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:92861 advisory. This advisory provides security fixes for affected packages used by Red Hat Satellite. The updates address the vulnerabilities described...

Google Chrome 70.0.3538.0 V8 Type Confusion

A proof of concept for a V8 TurboFan Object.create type confusion in Google Chrome version 70.0.3538.0 that achieves arbitrary memory read/write and executes calculator shellcode through a WebAssembly RWX page. https://packetstorm.news/download/238565...

WordPress Akismet 3.1.4 Cross Site Scripting

WordPress Akismet plugin versions 2.5.0 through 3.1.4 contain a stored cross site scripting vulnerability. This proof of concept submits a crafted payload that executes when viewed by an administrator. https://packetstorm.news/download/238548...

Joomla Content Editor 2.9.99.4 Unauthenticated Remote Code Execution

Joomla Content Editor versions through 2.9.99.4 contain an improper access control vulnerability in profile import functionality that allows unauthenticated attackers to upload PHP files and execute code. https://packetstorm.news/download/238566...

GeoServer 2.25.1 Remote Command Execution

GeoServer versions before 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain an unauthenticated remote code execution vulnerability in OGC request property-name expression evaluation. This proof of concept provides interactive command execution through WFS GetPropertyValue...

CVE-2026-103039: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,…

The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::createpost passing the submitted value to WordPress' unrestricted global maybeunserialize rather...

CVE-2026-116366

An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server. Fix has been pushed to the following open-source versions: v26.3.62.3-lts, v26.8.36.3-lts, v26.9.27.3-stabl...

PT-2026-133663

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE REGISTRY LAUNCH HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry...

CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKEREGISTRYLAUNCHHOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-ru...

PT-2026-133465

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.42.6 n8n versions 2.43.x prior to 2.43.3 n8n versions 3.x prior to 3.0.1 Description Authenticated users with permissions to create, modify, or import workflows can execute JavaScript within the main process. This occur...

UBUNTU-CVE-2026-97209

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under th...

CVE-2026-110133: Red Hat: A flaw was found in Ghostscript

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated...

PT-2026-133434

🔴 Dahua Intelligent Connection Center: remote code execution via command injection CVE-2025-31704 A remote attacker can send a specially crafted request to run arbitrary commands on the affected system. Patch → V5.000.0000000.15 https://t.co/0JpnCOlkWo...

PT-2026-133613

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

CVE-2026-97209

Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory under th...

CVE-2026-93327: Google Cloud Application Integration: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…

A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was...

UBUNTU-CVE-2026-110133

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated...