(0Day) Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the checkdetdataset...

Linux Distros Unpatched Vulnerability : CVE-2026-118341

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HT...

Linux Distros Unpatched Vulnerability : CVE-2026-57200

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3,...

Jenkins LTS < 2.580.2 / Jenkins weekly < 2.588 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.580.2 or Jenkins weekly prior to 2.588. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape...

Linux Distros Unpatched Vulnerability : CVE-2026-118354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-118351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118348

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft...

WordPress Affiliate Toolkit arbitrary file upload vulnerability

WordPress Affiliate Toolkit versions 3.9.2 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient validation of file types in the uploadimage function, weak checks on Content-Type prefixes, and the derivation of file extensions from URL paths...

PT-2026-133735

Name of the Vulnerable Software and Affected Versions WordPress versions 2.7.0 through 7.1.3 Description WordPress Core contains a Time-of-check Time-of-use TOCTOU race condition during full-package core upgrades. The issue occurs because the updater extracts files into predictable, web-accessibl...

Linux Distros Unpatched Vulnerability : CVE-2026-118313

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118310

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside...

Linux Distros Unpatched Vulnerability : CVE-2026-118330

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a...

MLflow 3.16.x Third-Party Scorer Scanner

MLflow versions 3.12.0rc0 through 3.16.x contain a third-party scorer deserialization issue that can allow remote code execution. This tool performs a single GET request to /version to identify potentially affected tracking servers...

PT-2026-128231

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...

Wing FTP Server path traversal vulnerability

Versions of Wing FTP Server prior to 8.2.6 contain a path traversal vulnerability. This vulnerability arises from the lack of validation on user base directories. Attackers with administrative privileges can use scripts to add user directories and bypass these base directories, potentially allowi...

Pie Register Premium arbitrary file upload vulnerability

Versions 3.8.4.0 and earlier of Pie Register Premium contain an arbitrary file upload vulnerability. This vulnerability arises because the pieregfileupload function fails to validate calls to file type checks, and the AJAX handler lacks nonce validation or permission checks. As a result,...

CVE-2026-118606: Exposed Dangerous Method or Function

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The...

PT-2026-130589

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

CVE-2026-118618: Improper Control of Generation of Code

Ultralytics parsemodel Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op...

PT-2026-127806

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...