CVE-2026-75827 Grav before 2.0.15 Arbitrary File Write via error_log

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

CVE-2026-19447 Stored XSS in Fileorbis Informatics's FileOrbis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...

CVE-2026-19447

FileOrbis (by Fileorbis Informatics Services Trade Inc.) is vulnerable to stored XSS due to improper input neutralization during web page generation. Affects versions before 16.5; CVSS 5.4 (MEDIUM), network exploitable with low privileges. No in-the-wild exploitation reported. Upgrade to 16.5 to ...

CVE-2026-34399

A flaw was found in FreeCAD. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code can be executed. This vulnerability is due to an eval call on untrusted data from the SVG template files, leading to arbitrary code execution...

PT-2026-78247

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.40 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target server...

Linux Distros Unpatched Vulnerability : CVE-2026-72412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - s390/mm: Fix handling of PAGEUNUSED pte bit The PAGEUNUSED softbit should not really be lying around. Its sole purpose is to signal to trytounmapone and...

PT-2026-77334

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by the browser. This flaw allows a remote attacker to execute arbitrary...

PT-2026-77327

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A use after free issue in the Browser component on Mac allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to enti...

PT-2026-77322

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An inappropriate implementation in the Media component of Google Chrome on Mac allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by inducing the...

PT-2026-77332

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A use after free issue exists in WebGL, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to visit a specially crafted HTML page. Use...

Linux Distros Unpatched Vulnerability : CVE-2026-72064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain...

Linux Distros Unpatched Vulnerability : CVE-2026-72358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pt: prevent invalid cursor access for purged BOs During a page table walk for binding...

Linux Distros Unpatched Vulnerability : CVE-2026-72173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/proc/taskmmu: do not warn on seeing non-migration pmd entry Patch series mm/hmm: A fix and a selftest, v3. Patch 1 fixes a stale warning present from the tim...

PT-2026-78245

Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 2.17.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server and lat...

PT-2026-77328

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description An information leak in Skia allows a remote attacker to potentially bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from one...

Linux Distros Unpatched Vulnerability : CVE-2026-72362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/xe/pt: Fix NULL pointer dereference in xeptzapptesentry The page-table walk framework may pass a NULL child pointer for unpopulated entries. xeptzapptesentr...

CVE-2026-72132

A flaw was found in the Linux kernel's Network File System NFS component. The nfsfoliomarkunstable and nfsfolioclearcommit functions incorrectly account for unstable writes, charging the full folio size for each sub-folio request. This inflated accounting can push the system's dirty page threshol...

CVE-2026-34399

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...

DEBIAN-CVE-2026-34399

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...

CVE-2026-34399 FreeCAD: Arbitrary Code Execution via eval() on untrusted SVG template scale field in BIM TechDraw Page

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable...