PT-2026-128333

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

PT-2026-128321

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The...

WordPress Rank Math SEO deserialization injection vulnerability

WordPress Rank Math SEO versions 1.0.276 and earlier contain a deserialization injection vulnerability. This vulnerability arises because the updateMeta REST API endpoint deserializes untrusted input, leading to PHP object injection. It can be exploited via a POP chain to write a webshell into th...

CVE-2026-109384: melograno The Innovative Form Builder – IvyForms: The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions…

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

Ultralytics deserialization injection vulnerability

Version 8.4.65 of Ultralytics contains a deserialization injection vulnerability. This flaw arises because the loaddatasetcachefile function fails to validate user-supplied data, allowing untrusted data to be deserialized. As a result, remote attackers may execute arbitrary code within the contex...

CVE-2026-44179: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in...

PT-2026-128328

Ultralytics check det dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

Linux Distros Unpatched Vulnerability : CVE-2026-118327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118311

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute...

Linux Distros Unpatched Vulnerability : CVE-2026-118358

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...

Linux Distros Unpatched Vulnerability : CVE-2026-118312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to execute...

PT-2026-128327

Ultralytics torch load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

PT-2026-127877

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext update tmpl function. This makes it possible for unauthenticated attackers...

CVE-2026-118613: Deserialization of Untrusted Data

Ultralytics torchload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118604: Stack-based Buffer Overflow

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. T...

PT-2026-128326

Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this...

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...