Linux Distros Unpatched Vulnerability : CVE-2026-90576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the...

PT-2026-91733

A vulnerability has been found in GPAC 26.07.0. Affected is the function gf sg dom event bubble of the file src/scenegraph/dom events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been...

Langflow AI Custom Component Authenticated Remote Code Execution

Langflow versions 1.0.0 through 1.11.1 are susceptible to authenticated remote code execution due to improper enforcement of security restrictions of code generation on the /api/v1/customcomponent endpoint. The endpoint accepts attacker controlled code that is then passed to Pythons exec function...

iLEAPP 2026.4.0 Cross Site Scripting

iLEAPP version 2026.4.0 is vulnerable to persistent cross site scripting in the generated SMS/iMessage chat HTML report. https://packetstorm.news/download/231359...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

Windows Push Notifications Local Privilege Escalation Research

Microsoft Windows contains a race condition in the Push Notifications service that can result in local privilege escalation. Research into patched and unpatched versions of wpncore.dll identifies a use-after-free condition involving PresentationEndpointFacade methods during notification platform...

PT-2026-91170

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3 user/yot3 pass causes sql injection. It is possible to initiate the attack remotely. The explo...

PT-2026-91177

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been ma...

PT-2026-91109

A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted element is the function FileOperationsManager of the file hexstrike server.py of the component API Files Endpoint. The manipulation of the argument filename leads to path...

EUVD-2023-60685

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

PT-2026-91182

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravity json.c of the component udp json-parser. Such manipulation leads to integer overflow. The attack may be performed from remote. The exploit has been...

PT-2026-91157

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc. The manipulation of the argument targetAPSsid leads to os command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be...

PT-2026-91117

A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products handler.php of the component Product Management Module. Executing a manipulation of the argument Product Name can lead to cross site...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

PT-2026-91202

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been made publi...

CVE-2026-89696

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIGNFSDV42INTERSSC is enabled, nfsd4putfh can return success with fhdentry and fhexport both NULL if fhverify returns nfserrstale and putfh-noverify is...

PT-2026-91242

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New GUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotel...

Important: gstreamer1-plugins-base

Issue Overview: GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. User interaction is required to exploit this vulnerability in that the target mu...

Linux Distros Unpatched Vulnerability : CVE-2026-90994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sssd, specifically within the PAM Pluggable Authentication Modules responder's protocol v1 parser, pamparseindata. A local client with acces...

Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2026-2147)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2147 advisory. GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions an...