CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms WordPress plugin is vulnerable to an unauthenticated arbitrary file upload in versions up to and including 1.6.0 . The root cause lies in the is_file_type_valid() function, which uses the attacker-controlled type parameter as regex keys within the...

CVE-2026-52098

Flowise 3.1.2 (an open-source flow-based LLM application builder) is vulnerable to remote code execution via the /api/v1/prediction/ endpoint, requiring no authentication. The CVSS 3.1 score is 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N. CISA's SSVC assessment rates exploitation as none ...

PT-2026-89612

🚨 CVE-2026-78571 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input. 🎖@cveNotify...

PT-2026-89725

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with pat...

EUVD-2026-75622

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri urllauncher.dart, OpenFilex.open, localPathRegex commonpatterns.dart components...

AlmaLinux 10 : valkey (ALSA-2026:64796)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:64796 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 valkey: Valkey: Remote code execution via use-after-free in...

CVE-2026-52097

AppFlowy 0.11.8 is affected by a vulnerability allowing a remote attacker to execute arbitrary code through the afLaunchUri , _afLaunchLocalUri (url_launcher.dart), OpenFilex.open , and localPathRegex (common_patterns.dart) components. The CNA-assigned CVSS 3.1 score is 6.8 (MEDIUM) with a Physic...

Security Updates for Microsoft Access Products C2R (September 2026)

The Microsoft Access Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network. CVE-2026-69529, CVE-2026-69778 - Stack-based buffer overflow ...

CVE-2026-52098

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint...

ALSA-2026:66347 Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS...

PT-2026-89589

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

PT-2026-89200

🚨 CRITICAL WORDPRESS RCE — A NEW CVSS 9.8 FLAW CAN LET UNAUTHENTICATED ATTACKERS UPLOAD EXECUTABLE FILES. CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms ≤1.6.0. No login. No user interaction. CyberSignal Priority: 🔴 VERY HIGH 1/8 The flaw is in the plugin's file-upload...

PT-2026-89721

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS...

RHEL 10 : freerdp (RHSA-2026:66349)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66349 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP...

Fedora 43 : perl-Net-DNS (2026-1237afef8a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1237afef8a advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

RHEL 9 : freerdp (RHSA-2026:66347)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66347 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

EUVD-2026-75621

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint...

PT-2026-89492

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...

PT-2026-89575

Summary POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled binary and versionCommand values. After saving the custom agent, the same request calls refreshAgentCache, which triggers agent version detection. The version probe eventually runs: ts...