Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — Next.js Flight Deserialization RCE Remote...

EUVD-2026-56983

Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-71202

Joomla 6.1.1 contains a path traversal vulnerability in the com joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...

PT-2026-71269

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A stack-based buffer overflow allows a remote attacker to execute arbitrary code. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer ...

PT-2026-71350

Name of the Vulnerable Software and Affected Versions WolfStack versions prior to 25.9.2 Description A hard-coded cluster-authentication secret is compiled into every build and published as a constant in src/auth/mod.rs. This allows remote unauthenticated attackers to bypass authentication by...

TencentOS Server 4: pcp (TSSA-2026:0829)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0829 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Linux Distros Unpatched Vulnerability : CVE-2026-19556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-72556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the...

Microsoft Edge (Chromium) < 151.0.4129.78 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.78. It is, therefore, affected by multiple vulnerabilities as referenced in the August 11, 2026 advisory. - Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows...

ROS-20260812-73-0023

The vulnerability in Wireshark is related to overflowing of buffers in the stack. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

FreeBSD : gitea -- Multiple vulnerabilities (f4af92f7-95ae-11f1-a6f7-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4af92f7-95ae-11f1-a6f7-b42e991fc52e advisory. Gitea reports This release addresses the following security vulnerabilities. Please upgrade as...

PT-2026-71122

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account...

PT-2026-71025

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain...

WP < 7.0.4 - Author+ RCE via PDF Upload

Description WordPress does not properly validate PDF files before generating thumbnail when the PHP Imagick extension and GhostScript are used, which could allow users with a role of author and above to upload malicious PDF filer containing php code and lead to RCE...

PT-2026-71036

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The PROFINET service is affected by a buffer overflow, which occurs when a program writes more data to a block of memory than it can hold. This issue exists in t...

PT-2026-71353

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description A buffer overflow exists in the IXF IMPORT parser. A buffer overflow occurs when a program writes more data to a block of memory, or buffer, than it is...

PT-2026-71173

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com data parameter. When a notification command references $NOTIFICATIONCOMMENT$ or $NOTIFICATIONAUTHOR$ in a...

PT-2026-71139

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.3.1 Description The serialization layer fails to restrict the classes imported during the reconstruction of exception nodes. By calling import string on a class name and instantiating it with arguments from a...

PT-2026-76562

Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...

PT-2026-71049

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...