WordPress IvyForms arbitrary file upload vulnerability

WordPress IvyForms versions 1.5.1 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient file type validation in the filterFiletypeAndExt function; it lacks a list of prohibited extensions and overrides WordPress’s built-in MIME and extension...

PT-2026-128320

Alpine iLX-F511 prh sdp service search decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a...

CVE-2026-118683: Improper Control of Generation of Code

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.init, which passes a bundle's configs/logging.conf to logging.config.fileConfig that evals handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Pytho...

Eclipse Che machine exec command injection vulnerability

In Eclipse Che Machine Exec versions 7.0.0 through 7.122.0, there is a command injection vulnerability. This vulnerability arises because the che-machine-exec service, when constructing shell commands, incorporates user-controllable inputs such as username and namespace fields from the /exec/init...

CVE-2026-114278: Eclipse Foundation Eclipse Che: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and…

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

Linux Distros Unpatched Vulnerability : CVE-2026-118315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via ...

Linux Distros Unpatched Vulnerability : CVE-2026-118342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-118329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTM...

Linux Distros Unpatched Vulnerability : CVE-2026-118346

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118343

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to execute arbitrary code outside...

Linux Distros Unpatched Vulnerability : CVE-2026-118349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Race condition in artifact extraction allows arbitrary file creation

To prevent writing files outside the target directory, Jenkins refuses to write files through symbolic links when extracting archived artifacts on the controller. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its...

RCE vulnerability in XStream deserialization due to improper `resolves-to` attribute handling

Jenkins uses XStream for serialization and deserialization of configuration and build data. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that only allows deserialization of types defined in Jenkins core or plugins, or explicitly allowed type...

Link following vulnerability allows arbitrary file read

When renaming an item, Jenkins moves its directory on the controller file system, or copies it if it cannot be moved. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed. This allows attackers with Item/Create and...

MONAI Project code injection vulnerability

In versions MONAI 1.2.0 through 1.6.1, there is a code injection vulnerability. This vulnerability arises because ConfigWorkflow.init passes the bundle’s configs/logging.conf to logging.config.fileConfig, which then executes eval on the handler class and args fields. As a result, attackers can...

Linux Distros Unpatched Vulnerability : CVE-2026-57189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-118359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-118331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pag...

Linux Distros Unpatched Vulnerability : CVE-2026-118309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside th...