CVE-2026-19912

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...

CVE-2026-18445

There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This...

CVE-2026-18444

There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI...

CVE-2026-64204

NI LabVIEW contains an out-of-bounds write vulnerability triggered when loading a specially crafted VI (Virtual Instrument). This memory corruption can lead to information disclosure or arbitrary code execution . Affected versions are NI LabVIEW 2026 Q3 (26.3.0) and prior . Exploitation requires ...

CVE-2026-64203 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 26.3.0 and...

CVE-2026-64201 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 26.3.0 and...

SonicWall NetExtender Linux Client Multiple Vulnerabilities

1 CVE-2026-66152 - SonicWall NetExtender arbitrary file write via path traversal vulnerabilityA Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root. CVSS Score: 8.8 CVSS Vector:...

CVE-2026-16234

CVE-2026-16234 is a memory corruption vulnerability — specifically an Out-of-Bounds Read — in NI LabVIEW triggered when loading a specially crafted VI. Successful exploitation requires user interaction (opening the malicious file), with no prior privileges needed. The flaw can lead to information...

EUVD-2026-65585

Webkul QloApps does not perform proper validation on uploaded file extensions or MIME types before moving the file to a publicly accessible directory. A remote, authenticated attacker with administrative privileges could upload executable files and achieve remote code execution. Fixed in 153ec1c...

CVE-2026-75496

Webkul QloApps contains an improper file upload validation flaw. The application fails to properly validate uploaded file extensions or MIME types before moving the file to a publicly accessible directory . A remote, authenticated attacker with administrative privileges can exploit this by upload...

CVE-2026-59186

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, a crafted tiled EXR can trigger a heap out-of-bounds write on 32-bit/ILP32 builds when read...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path through the CorpusReader.init constructor and the LinThesaurusCorpusReader and PanLexLiteCorpusReader...

CVE-2026-59184

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row return an...

CVE-2026-59184 OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row return an...

CVE-2026-59184

OpenEXR (the reference implementation for the EXR image format, widely used in motion picture pipelines) is affected by a memory corruption vulnerability in TypedFlatImageChannel::row() . A crafted EXR file with a nonzero dataWindow.min causes the function to return an invalid heap pointer, leadi...

CVE-2026-59184 OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 allow a crafted EXR with a nonzero dataWindow.min to make TypedFlatImageChannel::row return an...

browse-mcp has an arbitrary file write via unconfined download and state paths

Impact browserdownload wrote a fetched file to joinsavedir, filename with no validation of savedir, and browsersavestate / browserloadstate honored an explicit path unchanged. The MCP caller controls these arguments a malicious MCP client, or an autonomous agent steered by indirect prompt injecti...

EUVD-2026-65581

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browserdownload writes a fetched response body to joinsavedir, filename without validating the caller-controlled savedir, while browsersavestate and browserloadstate honor a caller-controlled path...

CVE-2026-55557 browse-mcp: Arbitrary file write via unconfined download and state paths

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browserdownload writes a fetched response body to joinsavedir, filename without validating the caller-controlled savedir, while browsersavestate and browserloadstate honor a caller-controlled path...

CVE-2026-55557

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2 , the browser_download function writes a fetched response body to join(save_dir, filename) without validating the caller-controlled save_dir, and browser_save_state / browser_load_state honor a cal...