NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX697263)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-64.32, or 14.1 prior to 14.1-73.49, or 13.1-FIPS/NDcPP prior to 13.1-37.286, or 14.1-FIPS prior to 14.1-73.49-FIPS. It is, therefore, affected by multiple vulnerabilities in its...

VMSA-2026-0008: Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)

Advisory ID: | VMSA-2026-0008.1 ---|--- Advisory Severity: | Critical CVSSv3 Range: | 7.5-9.8 Synopsis: | Node.js Brotli decoder out-of-bounds write remote code execution vulnerability CVE-2026-111497 Issue date: | 2026-10-27 Updated on: | 2026-10-28 CVEs | CVE-2026-111497 1. Impacted Products...

VulnCheck KEV: CVE-2026-103688

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

(0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torchload function...

N-able N-central Monitoring Code Execution

The vulnerability in the N-able N-central monitoring and IT infrastructure management platform involves improper handling of instructions in statically saved code. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

(0Day) Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loaddatasetcachefi...

(0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsemodel functio...

PT-2026-130589

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

PT-2026-128325

Name of the Vulnerable Software and Affected Versions Alpine iLX-F511 affected versions not specified Description An issue exists in the Android Auto service where the system fails to properly validate the length of user-supplied data before copying it into a fixed-length stack-based buffer. This...

CVE-2026-84999: Pie Register Pie Register Premium: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and…

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

CVE-2026-103408: Juniper Networks Session Smart Router: A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an…

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply...

Fastjson 1.2.83 Remote Code Execution

Fastjson versions 1.2.68 through 1.2.83 contain a remote code execution vulnerability when parsing attacker-controlled JSON in a Spring Boot executable fat-JAR. A proof of concept is included. https://packetstorm.news/download/238048...

Juniper Networks Session Smart Router buffer error vulnerability

Versions prior to Juniper Networks Session Smart Router 7.0.5, versions 7.1.x prior to 7.1.7, and versions 7.2.x prior to 7.2.3 contain a buffer error vulnerability. This vulnerability stems from a stack buffer overflow in the DHCP client, potentially allowing unauthenticated local network...

PT-2026-127792

Name of the Vulnerable Software and Affected Versions Pie Register Premium versions prior to 3.8.4.1 Description An unrestricted file type upload flaw exists in the piereg file upload function. The issue occurs because the plugin uses wp check filetype and wp check filetype and ext for validation...

Ultralytics command injection vulnerability

Version 8.4.65 of Ultralytics contains a command injection vulnerability. This flaw arises because the torchsafeload function fails to perform adequate validation on user-supplied strings prior to invoking system calls; as a result, remote attackers can execute arbitrary code after users have...

Dell PowerProtect Data Domain digital error vulnerability

Versions 7.7.1.0 through 8.8 of Dell PowerProtect Data Domain, versions 7.13.1.0 through 7.13.1.80 of LTS2024, versions 8.3.1.0 through 8.3.1.40 of LTS2025, and versions 8.6.1.0 through 8.6.1.20 of LTS2026 contain a numeric error vulnerability. This vulnerability stems from integer overflow or...

CVE-2026-103688: Unknown Checkout Files Upload for WooCommerce: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its…

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that...

CVE-2026-67074: HCL Software BigFix AEX: HCL BigFix AEX is affected by a Remote Code Execution Vulnerability

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise...

CVE-2026-118616: Improper Control of Generation of Code

Ultralytics parsemodel Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op...

XWiki SAS Pro Macros code injection vulnerability

Versions 1.13 through 1.14.5 of XWiki SAS Pro Macros contain a code injection vulnerability. This vulnerability arises because the “excerpt-include” macro fails to properly escape the title of the included page, allowing the “excerpt” content to be executed with macro privileges. Both title...