PT-2026-121343

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design save svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a CONTENT...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request-state corruption flaw. This proof of concept demonstrates a build-specific unauthenticated command-execution chain against PHP version 8.4.7 Apache/modphp using a related stale-global-state flaw...

PHP 8.5.11 php2shell Vulnerability Scanner

PHP versions 5.4.0 through 8.5.11 contain two remote code execution flaws involving request parsing state. The supplied tool fingerprints targets and can send active validation probes...

NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4443 by default. The issue results from the lack of...

PT-2026-135023

Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known workaround for affected applications with such use cache functions. Y...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a memory corruption flaw in affected interfaces. Unauthenticated neighboring attackers can exploit this vulnerability to achieve remote code execution. Successful exploitation allows them to execute arbitrary code with privileged...

Apache Log4j 2.14.1 JNDI Remote Code Execution

Apache Log4j versions 2.0-beta9 through 2.14.1 contain a JNDI lookup vulnerability that may allow remote code execution when attacker-controlled input is logged...

ROS-20261022-73-0099

The vulnerability in libmongocrypt is related to insufficient neutralization of special elements in the query. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-121640

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A buffer overflow in the PAPI protocol allows an authenticated remote attacker with high privileges to execute arbitrary code as a privileged user on the underlying operating system. A buffer...

Rocky Linux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792704664)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792704664 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...

KLA91370 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution...

Webasyst security vulnerability

A security vulnerability exists in Webasyst Framework versions 4.0.3 and earlier. This vulnerability stems from the redirecturi parameter in OAuth authorization URLs not being properly validated, potentially allowing remote attackers to execute arbitrary code...

ROS-20261022-73-0015

The vulnerability in freerdp3 is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Rocky Linux 9 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_86169)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686169 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information...

AlmaLinux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792704664)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792704664 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...

PT-2026-121485

Summary The GitHub Action bundled with Black can read the version from tool.black.required-version if use pyproject is set to True. This version is not validated and therefore can be used to execute untrusted code in the context of a victim's repository. Details This is similar to the previous...

Debian dsa-6576 : bind9 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6576 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6576-1 [email protected] https://www.debian.org/securit...

Rocky Linux 10.2 [CIQ] Security Update: aspnetcore-runtime-8.0 / aspnetcore-runtime-dbg-8.0 / etc Multiple Vulnerabilities (crlsa-2026_86168)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686168 advisory. dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability CVE-2026-58280 dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Informatio...

brotli -- out-of-bounds write permits remote code execution

-Brotli project reports: CVE-2026-111497: out-of-bounds write permits remote code execution...

PT-2026-135022

Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution RCE when Next.js runs on glibc-based Linux. Workaround Ensure the version of sharp used by Next.js is greater than or equal to 0.35.5. Fresh...