RHEL 9 : gegl04 (RHSA-2026:62170)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62170 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

ALSA-2026:62425 Important: gegl security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

CVE-2026-82524: Unrestricted Upload of File with Dangerous Type

UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public stora...

ALSA-2026:62420 Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

CVE-2026-14357: Missing Authorization

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

CVE-2026-84645: Improper Control of Generation of Code

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...

CVE-2026-84671: Improper Limitation of a Pathname to a Restricted Directory

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

Important: gegl security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

CVE-2026-82404: Improperly Controlled Modification of Object Prototype Attributes

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...

...[ More ]

This Metasploit module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelps legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An...

PT-2026-84768

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.580 Jenkins LTS versions prior to 2.568.3 Description Objects that store their configuration in independent top-level configuration files, such as jobs and global configuration, can be smuggled as nested field value...

PT-2026-84794

Jenkins File Parameter Plugin 425.v3fa 801681b 5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

PT-2026-84843

A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This...

Deserialization vulnerability

Jenkins uses serialization and deserialization to load and save configuration and build data using XStream. Types storing their configuration in their own files usually config.xml or build.xml, like agents, items, or builds, are indicated as such by implementing the Java interface PersistenceRoot...

The vulnerability of the setUrlFilterRules interface in the /lib/cste_modules/firewall.so module of the TOTOLINK A950RG router’s microprogramming system allows a malicious actor to execute arbitrary code or cause a service failure.

The vulnerability of the setUrlFilterRules interface in the /lib/cstemodules/firewall.so module of the TOTOLINK A950RG router’s microprogramming system is caused by a buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures remotely...

AlmaLinux 8 : gegl04 (ALSA-2026:62420)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:62420 advisory. gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 Tenable has extracted the preceding description block directly fro...

AlmaLinux 8 : gegl (ALSA-2026:62425)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:62425 advisory. gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 Tenable has extracted the preceding description block directly fro...

Linux Distros Unpatched Vulnerability : CVE-2026-66047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers...

RHEL 8 : gimp:2.8 (RHSA-2026:62507)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62507 advisory. The GIMP GNU Image Manipulation Program is an image composition and editing program. GIMP provides a large image manipulation toolbox,...