PT-2026-128215

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

PT-2026-127816

Name of the Vulnerable Software and Affected Versions Checkout Files Upload for WooCommerce WordPress plugin versions prior to 2.4.0 Description An issue exists where the plugin fails to validate uploaded file types when the accepted file types setting is left empty. This configuration, intended ...

CVE-2026-86389: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high...

PT-2026-130590

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

Ultralytics deserialization injection vulnerability

Version 8.4.65 of Ultralytics contains a deserialization injection vulnerability. This flaw stems from improper validation of user-supplied data by the torchload function, allowing untrusted data to be deserialized. As a result, remote attackers can execute arbitrary code under the current user’s...

PT-2026-129156

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow. init , which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary...

CVE-2026-104383: EagleCloud Aquila: Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on…

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection...

CVE-2026-111120: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all…

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtextupdatetmpl function. This makes it possible for unauthenticated attackers t...

PT-2026-128054

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high...

ROS-20261028-73-0023

The vulnerability in the Remote Development Extension package for the Visual Studio Code source code editor is related to improper handling of code generation. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

CVE-2026-118614: Improper Control of Generation of Code

Ultralytics checkdetdataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page ...

PT-2026-128329

Ultralytics torch safe load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious pa...

PT-2026-128284

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply...

CVE-2026-118609: Stack-based Buffer Overflow

Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this...

CVE-2026-118615: Improper Neutralization of Special Elements used in an OS Command

Ultralytics torchsafeload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

(0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from an exposed dangerous...

(0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Android Auto service. The issue results from the lack of proper...

Valkey clusterCreatePublishMsgBlock Numeric Truncation Error Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Valkey. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the parameters supplied to the PUBLISH message handler. The issue results from the la...

(0Day) Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torchsafeload...

(0Day) (Pwn2Own) Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSH service. The issue results from the use of hard-coded...