AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793285499)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793285499 advisory. - Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap...

PT-2026-132872

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption in Dawn allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-132878

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Improper input validation in CacheStorage allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-132887

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description Memory corruption occurs in the FileSystem component, which could allow a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted...

PT-2026-132885

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in the FileSystem component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially...

PT-2026-132868

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.79 Description A use after free issue exists in Frames, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. Use aft...

MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loadmodel function. The...

MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loading of SHAP explain...

CVE-2026-109618-exploit

PHP2Shell — CVE-2026-109618 / CVE-2026-109619 Unauthenticated Remote Code Execution in PHP 5.4.0 – 8.5.11 all web servers. CVSS 9.2 Critical · Patched 2026-10-21 · CISA KEV 2026-10-26 For authorized security testing only — on systems you own or have explicit written permission to test. Use withou...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

CVE-2026-54453 OpenCATS: Authenticated Remote Code Execution via SettingsUI (manageProfessional)

OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, the Professional License configuration feature in SettingsUI manageProfessional accepts administrator-controlled license key input that is reconstructed into a...

CVE-2026-54453

Prior to version 0.10.0 , OpenCATS is vulnerable to persistent arbitrary PHP execution due to an injection flaw in the SettingsUI (manageProfessional) feature. The application fails to safely escape administrator-controlled license key input before reconstructing it into a PHP define() statement ...

Exploit for CVE-2026-115905

Stopping RCE: you can't execute what you don't have !A malic...

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Summary In vLLM 0.30.0, ImageMediaIO passes attacker-controlled image bytes to Pillow's format autodetection without restricting the accepted formats; the request's MIME label does not constrain decoder selection. An EPS payload labeled image/png reached the host's Ghostscript executable. On a ho...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object proper...

Prototype Pollution

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object property...

Prototype Pollution

Overview @highcharts/dashboards is a Highcharts Dashboards framework Affected versions of this package are vulnerable to Prototype Pollution via the propertyPath parameter in AccordionMenu.ts, where user-controlled property path segments are applied to an object without validation. An authenticat...

Prototype Pollution

Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via Point.setNestedProperty in ts/Core/Series/Point.ts, which splits a dot-separated key path and traverses...

CVE-2026-114053

A flaw was found in vLLM. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution in the server process. By submitting a crafted multimodal request specifying an attacker-controlled code revision, an attacker can cause the application to load and execute...