PT-2026-107021

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in V8, the open-source high-performance JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox ...

Linux Distros Unpatched Vulnerability : CVE-2026-105315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function topython of the file haystack/backends/elasticsearchbackend.py of the...

PT-2026-106964

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the GarbageCollection component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A...

PT-2026-107030

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in Navigation allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free is a memory...

PT-2026-106396

Name of the Vulnerable Software and Affected Versions WooCommerce Designer Pro versions prior to 1.9.34 Description A code injection issue allows users with low-privileged subscriber accounts to execute arbitrary code on the server. Recommendations Update to version 1.9.34 or later...

CVE-2026-106269: Use After Free

Use after free in CSS in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-106372: Incorrect Authorization

Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

VulnCheck KEV: CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...

PT-2026-107083

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue exists in the Parser, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use...

CVE-2026-106341: Access of Resource Using Incompatible Type

Type confusion in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106872

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use after free issue in the Browser component allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free ...

CVE-2026-106194: Missing Authorization

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-106791

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload canary versions prior to 4.0.0-canary.34 Description A crafted request to the public first-register operation allows remote code execution. This occurs when local authentication is enabled and no initia...

CVE-2026-102163: Out-of-bounds Write

On affected Arista access points with Wireless Intrusion Prevention System WIPS active, an unauthenticated attacker within radio frequency RF proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution...

PT-2026-107189

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager versions prior to 6.14.1 Description Deserialization of untrusted data in the web interface allows an unauthenticated remote attacker to execute arbitrary code on the affected system. Deserialization is...

Next.js 15.5.6 Remote Code Execution

Next.js version 15.5.6 is affected by an unauthenticated remote code execution vulnerability in React Server Components request deserialization. This CTF deployment exposes a Server Action endpoint to demonstrate the issue...

PT-2026-107190

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2026-76751 Vendor → Unknown Severity → Critical — CVSS 9.8 Product → Unknown Date → 2026-10-06 A critical vulnerability Missing Support for Integrity Check has been disclosed affecting...

CVE-2026-105701: Unrestricted Upload of File with Dangerous Type

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-106315: Use After Free

Use after free in Modularization in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106401: Out-of-bounds Write

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...