Race condition in artifact extraction allows arbitrary file creation

To prevent writing files outside the target directory, Jenkins refuses to write files through symbolic links when extracting archived artifacts on the controller. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its...

RCE vulnerability in XStream deserialization due to improper `resolves-to` attribute handling

Jenkins uses XStream for serialization and deserialization of configuration and build data. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that only allows deserialization of types defined in Jenkins core or plugins, or explicitly allowed type...

Link following vulnerability allows arbitrary file read

When renaming an item, Jenkins moves its directory on the controller file system, or copies it if it cannot be moved. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed. This allows attackers with Item/Create and...

MONAI Project code injection vulnerability

In versions MONAI 1.2.0 through 1.6.1, there is a code injection vulnerability. This vulnerability arises because ConfigWorkflow.init passes the bundle’s configs/logging.conf to logging.config.fileConfig, which then executes eval on the handler class and args fields. As a result, attackers can...

Linux Distros Unpatched Vulnerability : CVE-2026-57189

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-118359

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-118331

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML pag...

Linux Distros Unpatched Vulnerability : CVE-2026-118309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside th...

Linux Distros Unpatched Vulnerability : CVE-2026-118320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted...

...[ More ]

This Python proof-of-concept targets AXIS Camera Station through its Axis.Remoting communication interface, using a crafted .NET deserialization payload to achieve remote code execution. The exploit implements the application's encrypted communication protocol, including RSA certificate exchange,...

Linux Distros Unpatched Vulnerability : CVE-2026-118353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118328

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromi...

Linux Distros Unpatched Vulnerability : CVE-2026-118334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-118304

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via ...

CVE-2026-118603: Stack-based Buffer Overflow

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

ggml llama.cpp buffer error vulnerability

Versions prior to b11865 of ggml llama.cpp contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds write in the ggml-rpc RDMA transport’s rdmarecv function. Unauthenticated peers can exploit this by sending HELLO messages to declare their RDMA capabilities; they may...

CVE-2026-105420: Wing Soft Technology Wing FTP Server: Wing FTP Server does not verify user's base folder

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner...

CVE-2026-117607: thexerteproject xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users…

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-1928: rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in…

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-118601: Use of Hard-coded Credentials

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...