CVE-2026-110874: Deserialization of Untrusted Data

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

CVE-2026-111144: NULL Pointer Dereference

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

PT-2026-114972

A stack overflow in the gensub ParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

CVE-2026-85634: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker...

PT-2026-114844

🚨 CVE-2026-16437 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and...

PT-2026-115127

Name of the Vulnerable Software and Affected Versions AdPlug versions prior to 2.5 Description A heap out-of-bounds read occurs in the CdmoLoader::load function within src/dmo.cpp. This issue allows an attacker to read data beyond a heap allocation by providing a truncated TwinTeam DMO file...

CVE-2026-52167

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

PT-2026-114815

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

Cisco Secure Email Gateway 16.0 AMP Arbitrary File Write

Cisco Secure Email Gateway versions 13.0 through 16.0 prior to Content Scanner Tools package 25.3.0.5525 contain a relative path traversal vulnerability in AMP File Reputation attachment handling that allows unauthenticated arbitrary file write...

PT-2026-114969

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2026-130349)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130349 advisory. An integer overflow in the libavfilter/vfscale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted...

Cisco Secure Email Gateway Advanced Malware Protection Privilege Escalation

The vulnerability of the Advanced Malware Protection module of the Cisco Secure Email Gateway protection tool is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files and execute...

RHEL 8 : lrzsz (RHSA-2026:83525)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:83525 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

Linux Distros Unpatched Vulnerability : CVE-2026-110830

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.32.0 fails to close prior serial handles in serialprocessirpcreate, allowing a malicious RDP server to exhaust file descriptors. Attackers can...

CVE-2026-111148: Out-of-bounds Read

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

ALSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

PT-2026-115066

bincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie init file in bincookie.h allocates a buffer using the actual .binarycookies file length but trusts the file-controlled num pages field as the loop bound for byte-swapping page sizes entries. A crafted file can make the loo...

CVE-2026-111230: External Control of File Name or Path

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

PT-2026-115154

Name of the Vulnerable Software and Affected Versions libsidplayfp versions prior to 3.1.2 Description A heap out-of-bounds read occurs when the software processes a PSID/RSID file with an unchecked data offset. An attacker can set the header data offset beyond the file size, causing the length...

CVE-2026-105032: Unrestricted Upload of File with Dangerous Type

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...