CVE-2026-55083

The information system DHIS2 is vulnerable to remote code execution (RCE) due to unsafe Java deserialization . This vulnerability affects versions 2.42.0 to before 2.42.5.1 and 2.43.0 to before 2.43.0.1 . An attacker could exploit this flaw to execute arbitrary code on the system. Remediation is ...

CVE-2026-102369 Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-102369 Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

Exploit for Expression Language Injection in Redhat Richfaces

RichFaces Paint2DResource — CVE-2018-12533 CTF lab A self-con...

CVE-2026-96658

A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution RCE by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed...

CVE-2026-12544

A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution chain that allows for both Server-Side...

CVE-2026-101888

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences...

CVE-2026-95318

A buffer overflow flaw was found in the Video component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556576976...

CVE-2026-95350

A buffer overflow flaw was found in the ANGLE component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/551573368...

plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

ImpactThe Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...

PYSEC-2026-4138 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...

PYSEC-2026-4077 LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

Summary LMDeploy's PyTorch DistServe/PD-disaggregation control plane used recvpyobj to deserialize messages received through a ZeroMQ PULL socket. PyZMQ implements recvpyobj using Python pickle deserialization, which can execute arbitrary code while reconstructing an object. The peer address used...

LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py

SummaryLMDeploy's PyTorch DistServe/PD-disaggregation control plane usedrecvpyobj to deserialize messages received through a ZeroMQ PULLsocket. PyZMQ implements recvpyobj using Python pickledeserialization, which can execute arbitrary code while reconstructingan object.The peer address used by th...

PYSEC-2026-4079 LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

Description The LMdeploy implements an rpc server AsyncRPCServer in zmqrpc.py for supporting the RPC communications. In its core functionality callandresponse, I found it will directly use the pickles.loads to deserialize the received messages without any sanitization, hence resulting in a remote...

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

DescriptionThe LMdeployimplements anrpc server AsyncRPCServer in zmqrpc.pyfor supporting the RPC communications. In its core functionalitycallandresponse, I found it will directly use thepickles.loadsto deserialize the received messages without any sanitization, hence resulting in a remote code...

Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

PYSEC-2026-4135 Picklescan missing detection when calling built-in python library function timeit.timeit()

Summary Using timeit.timeit function, which is a built-in python library function to execute remote pickle file. Details Pickle’s deserialization process is known to allow execution of function via reduce method. While Picklescan is meant to detect such exploits, this attack evades detection by...

PYSEC-2026-4132 Picklescan has a missing detection when calling built-in python profile.Profile.runctx

Summary Using profile.Profile.runctx, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to profile.Profile.runctx function in reduce method Then when the victim...

PYSEC-2026-4133 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

Summary Using idlelib.autocomplete.AutoComplete.fetchcompletions, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...

Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.fetch_completions

SummaryUsing idlelib.autocomplete.AutoComplete.fetchcompletions, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to...