CVE-2026-52098: Improper Control of Generation of Code

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint...

PT-2026-89463

Dell ThinOS 10, versions prior to 2605 10.2616, contain an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution...

PT-2026-89445

Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...

Fedora 43 : perl-Net-DNS (2026-1237afef8a)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1237afef8a advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

Fedora 44 : perl-Net-DNS (2026-a0607111e6)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a0607111e6 advisory. Update to Net-DNS 1.56 from 1.53. Security fixes: - CVE-worthy: Remote code injection via EDNS EXTENDED ERROR rt.cpan 179945 - Denial of Service via...

PT-2026-89589

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled...

Adobe Acrobat Reader DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DIC...

(Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...

(Pwn2Own) OpenAI Codex External Control of Configuration Setting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

RHEL 9 : freerdp (RHSA-2026:66347)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66347 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP serve...

Vulnerability of the functions CliprdrStream_Read(), wf_cliprdr_server_file_contents_response(), and cliprdr_read_file_contents_response() in the RDP client FreeRDP, allowing a intruder to execute arbitrary code

The vulnerability of the CliprdrStreamRead, wfcliprdrserverfilecontentsresponse, and cliprdrreadfilecontentsresponse functions in the RDP client FreeRDP is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

RHEL 10 : freerdp (RHSA-2026:66349)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66349 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP...

PT-2026-89400

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

PT-2026-89724

A remote code execution RCE vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state base...

PT-2026-89575

Summary POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled binary and versionCommand values. After saving the custom agent, the same request calls refreshAgentCache, which triggers agent version detection. The version probe eventually runs: ts...

CVE-2026-88889: Improper Neutralization of Special Elements used in an OS Command

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped...

Next.js Unauthenticated Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server. The affected versions include releases from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3,...