CVE-2026-107239: Veeam Management Pack for Microsoft System Center: A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution…

A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution RCE on servers running the Veeam Management Pack for Microsoft System Center Collector service...

PT-2026-132857

Name of the Vulnerable Software and Affected Versions Veeam Management Pack for Microsoft System Center versions 9.1 and earlier version 9 builds Description A member of the Veeam Virtualization Extensions Users group can perform remote code execution on servers running the Veeam Management Pack...

CVE-2026-104339: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

Linux Distros Unpatched Vulnerability : CVE-2026-116738

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: xorg-x11-server-Xwayland (UTSA-2026-147032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-147032 advisory. A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remot...

MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loadmodel function. The...

PT-2026-132888

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in the Input component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

PT-2026-132868

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in Frames, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use aft...

PT-2026-132872

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption in Dawn allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-132878

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Improper input validation in CacheStorage allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-132887

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the FileSystem component, which could allow a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted...

PT-2026-132885

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in the FileSystem component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially...

CVE-2026-109618-exploit

PHP2Shell — CVE-2026-109618 / CVE-2026-109619 Unauthenticated Remote Code Execution in PHP 5.4.0 – 8.5.11 all web servers. CVSS 9.2 Critical · Patched 2026-10-21 · CISA KEV 2026-10-26 For authorized security testing only — on systems you own or have explicit written permission to test. Use withou...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

CVE-2026-54453

Prior to version 0.10.0 , OpenCATS is vulnerable to persistent arbitrary PHP execution due to an injection flaw in the SettingsUI (manageProfessional) feature. The application fails to safely escape administrator-controlled license key input before reconstructing it into a PHP define() statement ...

Exploit for CVE-2026-115905

Stopping RCE: you can't execute what you don't have !A malic...

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...