WordPress 7.0.1 REST API Batch-Route Confusion

WordPress versions 6.9.0 through 7.0.1 contain a REST API batch-route confusion issue that, when combined with a related SQL injection vulnerability, may lead to remote code execution...

PT-2026-121485

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if use pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_86169)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686169 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information...

PT-2026-121395

In EmberZNet 9.1.1 and earlier, a malformed Simple Desc req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple Desc req before the attack can...

Rocky Linux 10.2 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_86168)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686168 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Informatio...

Debian dsa-6576 : bind9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6576 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6576-1 [email protected] https://www.debian.org/securit...

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-3304)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3304 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory i...

FreeBSD : PHP -- Multiple vulnerabilities (d8e16d08-cd2f-11f1-8135-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the d8e16d08-cd2f-11f1-8135-8447094a420f advisory. The PHP project reports: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilitie...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-3303)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3303 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory i...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 : PHP vulnerabilities (USN-8948-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / 26.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8948-1 advisory. It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker coul...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a command injection flaw in the command-line interface accessed via the PAPI protocol. An attacker adjacent to the system can send specially crafted PAPI packets to UDP port 8211, thereby achieving unauthenticated remote code execution...

PT-2026-121418

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect uri...

Webasyst security vulnerability

A security vulnerability exists in Webasyst Framework versions 4.0.3 and earlier. This vulnerability stems from the redirecturi parameter in OAuth authorization URLs not being properly validated, potentially allowing remote attackers to execute arbitrary code...

WG-CVE-2026-1555-Linux

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ ██║ ╚██╗ ██╔╝██╔══╝ ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗╚██████╔╝ ╚═════╝ ╚═══╝...

SUSE CVE-2026-94300

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "named". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially...

CVE-2026-76293 Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...

CVE-2026-76293

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, an attacker with the edit_manager_xml capability can achieve Remote Code Execution (RCE) . The vulnerability exists because Splunk Web evaluates user-controlled expressions from Manager XML without sufficient syntax restrict...

CVE-2026-76293 Remote Code Execution (RCE) through Splunk Web Manager Extensible Markup Language (XML) in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the editmanagerxml capability could execute arbitrary operating-system commands using the permissions of the user account running Splunk Enterprise by opening the affected configuration in the...

[slackware-security] php

New php packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/php80/php80-8.0.30-i586-2slack15.0.txz: Rebuilt. This update fixes the following critical remote code execution flaw: Avoid state corruption via...