Linux Distros Unpatched Vulnerability : CVE-2026-118315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via ...

Linux Distros Unpatched Vulnerability : CVE-2026-118342

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted...

PT-2026-127806

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

Linux Distros Unpatched Vulnerability : CVE-2026-118329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized resource in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to read memory outside the sandbox via a crafted HTM...

NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX697263)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-64.32, or 14.1 prior to 14.1-73.49, or 13.1-FIPS/NDcPP prior to 13.1-37.286, or 14.1-FIPS prior to 14.1-73.49-FIPS. It is, therefore, affected by multiple vulnerabilities in its...

(0Day) Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the torchload function...

(0Day) Ultralytics parse_model Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsemodel functio...

(0Day) Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the loaddatasetcachefi...

Link following vulnerability allows arbitrary file read

When renaming an item, Jenkins moves its directory on the controller file system, or copies it if it cannot be moved. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed. This allows attackers with Item/Create and...

RCE vulnerability in XStream deserialization due to improper `resolves-to` attribute handling

Jenkins uses XStream for serialization and deserialization of configuration and build data. To protect from common deserialization vulnerabilities, Jenkins uses a custom deserialization filter that only allows deserialization of types defined in Jenkins core or plugins, or explicitly allowed type...

Race condition in artifact extraction allows arbitrary file creation

To prevent writing files outside the target directory, Jenkins refuses to write files through symbolic links when extracting archived artifacts on the controller. Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its...

CVE-2026-118603: Stack-based Buffer Overflow

Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must...

ggml llama.cpp buffer error vulnerability

Versions prior to b11865 of ggml llama.cpp contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds write in the ggml-rpc RDMA transport’s rdmarecv function. Unauthenticated peers can exploit this by sending HELLO messages to declare their RDMA capabilities; they may...

CVE-2026-117607: thexerteproject xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users…

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-1928: rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in…

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with...

CVE-2026-118601: Use of Hard-coded Credentials

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

CVE-2026-118619: Improper Limitation of a Pathname to a Restricted Directory

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

PT-2026-128320

Alpine iLX-F511 prh sdp service search decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a...

MLflow 3.16.x Third-Party Scorer Scanner

MLflow versions 3.12.0rc0 through 3.16.x contain a third-party scorer deserialization issue that can allow remote code execution. This tool performs a single GET request to /version to identify potentially affected tracking servers...