PT-2026-64474

Name of the Vulnerable Software and Affected Versions WPForms Pro versions prior to 1.10.1.2 Description An arbitrary file upload issue exists in the ajax chunk upload finalize function. The flaw occurs because file type validation is performed after the chunk metadata and file contents are writt...

PT-2026-64452

Name of the Vulnerable Software and Affected Versions Knot Resolver versions prior to 6.4.1 Description A heap-based buffer overflow exists in the DoQ DNS-over-QUIC receive path, which could allow remote code execution. A heap-based buffer overflow occurs when a program writes more data to a...

Linux Distros Unpatched Vulnerability : CVE-2026-16445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a...

Linux Distros Unpatched Vulnerability : CVE-2026-16806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-65703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption b...

Linux Distros Unpatched Vulnerability : CVE-2026-66374

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ DNS- over-QUIC receive path. CVE-2026-66374 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2026-16805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

SUSE SLED15: aom-tools / libSvtAv1Enc1 / libaom-devel / libaom-devel-doc / etc (SUSE-SU-2026:3224-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3224-1 advisory. - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a proces...

EUVD-2026-48422

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK installpackages...

GHSA-WG5R-WC3X-39VC OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Summary A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint /authservice, PLL accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is...

GHSA-GF8H-GQ53-288J OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

CVE-2026-66040

FFmpeg

CVE-2026-66040 FFmpeg Heap Out-of-Bounds Write via PNG/APNG eXIf Encoder

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

CVE-2026-66040

FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...

GHSA-74H3-CXQ7-VC5Q Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id

Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...

GHSA-4R2P-27MH-5M22 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

SUSE CVE-2026-16806

Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

GHSA-3RP5-JJMW-4WV2 GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

Summary In GitPython None: if isinstancename, str and UNSAFECONFIGCHARSRE.searchname:...

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...