CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

libssh2: libssh2: Heap buffer overflow via integer overflow in publickey attribute allocation

A flaw in libssh2 allows a malicious SSH server to trigger a memory overflow by sending a manipulated attribute count. This can cause the connecting client to crash or allow unauthorized code execution...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — Next.js Flight Deserialization RCE Remote...

EUVD-2026-56983

Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

Microsoft Edge (Chromium) < 151.0.4129.78 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.78. It is, therefore, affected by multiple vulnerabilities as referenced in the August 11, 2026 advisory. - Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows...

FreeBSD : gitea -- Multiple vulnerabilities (f4af92f7-95ae-11f1-a6f7-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4af92f7-95ae-11f1-a6f7-b42e991fc52e advisory. Gitea reports This release addresses the following security vulnerabilities. Please upgrade as...

PT-2026-71202

Joomla 6.1.1 contains a path traversal vulnerability in the com joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...

PT-2026-71269

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A stack-based buffer overflow allows a remote attacker to execute arbitrary code. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer ...

PT-2026-71350

Name of the Vulnerable Software and Affected Versions WolfStack versions prior to 25.9.2 Description A hard-coded cluster-authentication secret is compiled into every build and published as a constant in src/auth/mod.rs. This allows remote unauthenticated attackers to bypass authentication by...

PT-2026-71122

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

Linux Distros Unpatched Vulnerability : CVE-2026-19556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

TencentOS Server 4: pcp (TSSA-2026:0829)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0829 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-72556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the...

WP < 7.0.4 - Author+ RCE via PDF Upload

Description WordPress does not properly validate PDF files before generating thumbnail when the PHP Imagick extension and GhostScript are used, which could allow users with a role of author and above to upload malicious PDF filer containing php code and lead to RCE...

PT-2026-71025

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

ROS-20260812-73-0023

The vulnerability in Wireshark is related to overflowing of buffers in the stack. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

PT-2026-71173

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

PT-2026-71139

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The serialization layer fails to restrict the classes imported during the reconstruction of exception nodes. By calling import string on a class name and instantiating it with arguments from a...

PT-2026-76562

Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...