PT-2026-63318

Name of the Vulnerable Software and Affected Versions AccountsService versions prior to 23.13.9-8ubuntu7 Description An Ubuntu-specific patch in the SetLanguage function only partially drops privileges before launching language helper scripts. While the effective UID/GID is changed to the target...

PT-2026-63271

Name of the Vulnerable Software and Affected Versions jsforce versions prior to 3.10.17 Description An OS command injection issue exists within the SFDX Connection Registry component. The flaw is located in the execCommand function within the lib/registry/sfdx.js library. This allows for the...

📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution

WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

PT-2026-61950

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users...

EulerOS Virtualization 2.10.0 : cups (EulerOS-SA-2026-2846)

According to the versions of the cups package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in ...

Linux Distros Unpatched Vulnerability : CVE-2026-15811

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memor...

CVE-2026-15905

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. Chromium security severity: High...

CVE-2026-53727

A flaw was found in cssparser from 2.2.0 before 3.0.0. CssParser::Parserreadremotefile used by loaduri! and @import handling in addblock! issues HTTP/HTTPS requests without host, IP, or scheme restrictions, including to loopback and RFC1918 targets, and recursively follows Location redirects. Tho...

CVE-2026-15905

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. Chromium security severity: High...

CVE-2026-15905

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. Chromium security severity: High...

CVE-2026-15905

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. Chromium security severity: High...

CVE-2026-15905

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. Chromium security severity: High...

GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

DEBIAN-CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass...

CVE-2026-64624

CVE-2026-64624 affects FreeRDP prior to 3.28.0. The issue arises because lines starting with a forward slash in RDP files are treated as raw command-line options, exposing the CLI parser surface to untrusted files. This enables attackers to craft malicious RDP files leveraging options such as /rd...

CVE-2026-47128 nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...