PT-2026-128325

Name of the Vulnerable Software and Affected Versions Alpine iLX-F511 affected versions not specified Description An issue exists in the Android Auto service where the system fails to properly validate the length of user-supplied data before copying it into a fixed-length stack-based buffer. This...

N-able N-central Monitoring Code Execution

The vulnerability in the N-able N-central monitoring and IT infrastructure management platform involves improper handling of instructions in statically saved code. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Apache Tomcat 11.0.1 Race Condition / Remote Code Execution

Apache Tomcat versions 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1 contain a race condition that can allow JSP execution when the DefaultServlet is writable on a case-insensitive filesystem. This proof of concept uses concurrent PUT and GET requests to...

Linux Distros Unpatched Vulnerability : CVE-2026-118316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via ...

Linux Distros Unpatched Vulnerability : CVE-2026-118317

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a craft...

NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX697263)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-64.32, or 14.1 prior to 14.1-73.49, or 13.1-FIPS/NDcPP prior to 13.1-37.286, or 14.1-FIPS prior to 14.1-73.49-FIPS. It is, therefore, affected by multiple vulnerabilities in its...

VMSA-2026-0008: Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)

Advisory ID: | VMSA-2026-0008.1 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 7.5-9.8 Synopsis: | Node.js Brotli decoder out-of-bounds write remote code execution vulnerability CVE-2026-111497 Issue date: | 2026-10-27 Updated on: | 2026-10-28 CVEs | CVE-2026-111497 1. Impacted Products...

VulnCheck KEV: CVE-2026-103688

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

Linux Distros Unpatched Vulnerability : CVE-2026-118329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTM...

CVE-2026-84999: Pie Register Pie Register Premium: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and…

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

CVE-2026-103408: Juniper Networks Session Smart Router: A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an…

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply...

Juniper Networks Session Smart Router buffer error vulnerability

Versions prior to Juniper Networks Session Smart Router 7.0.5, versions 7.1.x prior to 7.1.7, and versions 7.2.x prior to 7.2.3 contain a buffer error vulnerability. This vulnerability stems from a stack buffer overflow in the DHCP client, potentially allowing unauthenticated local network...

PT-2026-127792

Name of the Vulnerable Software and Affected Versions Pie Register Premium versions prior to 3.8.4.1 Description An unrestricted file type upload flaw exists in the piereg file upload function. The issue occurs because the plugin uses wp check filetype and wp check filetype and ext for validation...

Ultralytics command injection vulnerability

Version 8.4.65 of Ultralytics contains a command injection vulnerability. This flaw arises because the torchsafeload function fails to perform adequate validation on user-supplied strings prior to invoking system calls; as a result, remote attackers can execute arbitrary code after users have...

Dell PowerProtect Data Domain digital error vulnerability

Versions 7.7.1.0 through 8.8 of Dell PowerProtect Data Domain, versions 7.13.1.0 through 7.13.1.80 of LTS2024, versions 8.3.1.0 through 8.3.1.40 of LTS2025, and versions 8.6.1.0 through 8.6.1.20 of LTS2026 contain a numeric error vulnerability. This vulnerability stems from integer overflow or...

CVE-2026-103688: Unknown Checkout Files Upload for WooCommerce: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

CVE-2026-67074: HCL Software BigFix AEX: HCL BigFix AEX is affected by a Remote Code Execution Vulnerability

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

CVE-2026-118616: Improper Control of Generation of Code

Ultralytics parsemodel Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op...

XWiki SAS Pro Macros code injection vulnerability

Versions 1.13 through 1.14.5 of XWiki SAS Pro Macros contain a code injection vulnerability. This vulnerability arises because the “excerpt-include” macro fails to properly escape the title of the included page, allowing the “excerpt” content to be executed with macro privileges. Both title...

PT-2026-127862

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...