PT-2026-82757

An integer overflow in the libavfilter/vf scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...

SUSE SLED15 / SLES15 Security Update : git-lfs (SUSE-SU-2026:3801-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3801-1 advisory. This update for git-lfs fixes the following issue: - CVE-2025-26625: certain commands may write to files visible outsid...

Adobe Substance 3D Sampler <= 6.0.1 Multiple Arbitrary Code Execution Vulnerabilities (APSB26-121)

The version of Adobe Substance 3D Sampler installed on the remote host is prior or equal to 6.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-121 advisory. - Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in...

CVE-2026-37068

An arbitrary file write vulnerability in Veno File Manager Project 4.4.9 affects the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user holding the super administrator role can overwrite any PHP file in the application by sending a specially crafted POST reque...

CVE-2026-37064

Veno File Manager Project 4.4.9 is vulnerable to user enumeration through the endpoint /vfm-admin/ajax/usr-check.php . An unauthenticated attacker can send a specially crafted POST request with a chosen user_name parameter to determine whether a given user exists in the application. This informat...

CVE-2026-37073

Veno File Manager Project 4.4.9 contains an incorrect access control flaw in /vfm-admin/ajax/sendfiles.php that allows an unauthenticated attacker to send emails through the application's configured SMTP server by issuing a POST request with the required parameters and header. A PoC is publicly a...

CVE-2026-75337

Yu AI Code Mother v4.3 is vulnerable to path traversal in its static resource interface /api/static/{deployKey}/. The user-controlled path is concatenated to the preview root directory without normalization , allowing anonymous attackers to read files outside the intended directory. The vulnerabi...

CVE-2026-75339

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82784

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...

PT-2026-82649

Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description A flaw in the domai...

PT-2026-82623

Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes t...

PT-2026-82763

An integer overflow in the hScale16To19 c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...

CVE-2026-38344

CVE-2026-38344 is a NULL pointer dereference in the get_min_buffer_size function located in /libswscale/slice.c of FFmpeg (version N-122528-gdd2976b9e1). An attacker can trigger a Denial of Service (DoS) by supplying a crafted video file to the affected library. No specific remediation or patched...

PT-2026-82804

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import session/export session of the file mcp sequential thinking/server.py of the component Import Session/Export Session. Such manipulation of the argument file path leads to path traversal...

PT-2026-82786

A path traversal vulnerability exists in the built-in preview/development web server of Lektor 3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensiti...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-37067

CVE-2026-37067 is an incorrect access control flaw in the file /vfm-admin/admin-panel/view/save-cvs.php of Veno File Manager Project 4.4.9 . An unauthenticated attacker can send a specially crafted POST request to extract all application logs from a chosen date forward, resulting in a low confide...

CVE-2026-37069

Veno File Manager Project version 4.4.9 is affected by an Absolute Path Disclosure in the file /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php. By sending a simple unauthenticated GET request to this endpoint, an attacker can determine the system directory in which the a...

CVE-2026-37071

CVE-2026-37071 affects Veno File Manager Project 4.4.9 in the Actions::renameFile() function. An authenticated attacker holding the 'reanme' permission can send a specially crafted POST request that renames the application configuration file, triggering a configuration rebuild that resets super a...

CVE-2026-37066

CVE-2026-37066 affects Veno File Manager Project 4.4.9 , where a path traversal vulnerability in the endpoints /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php leads to arbitrary file read. An authenticated attacker with the super administrator role can disclose sensitive information by sen...