XWiki SAS Pro Macros code injection vulnerability

Versions 1.13 through 1.14.5 of XWiki SAS Pro Macros contain a code injection vulnerability. This vulnerability arises because the “excerpt-include” macro fails to properly escape the title of the included page, allowing the “excerpt” content to be executed with macro privileges. Both title...

WordPress Rank Math SEO deserialization injection vulnerability

WordPress Rank Math SEO versions 1.0.276 and earlier contain a deserialization injection vulnerability. This vulnerability arises because the updateMeta REST API endpoint deserializes untrusted input, leading to PHP object injection. It can be exploited via a POP chain to write a webshell into th...

CVE-2026-109384: melograno The Innovative Form Builder – IvyForms: The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions…

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

CVE-2026-44179: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handling in...

PT-2026-128212

Name of the Vulnerable Software and Affected Versions Eclipse Che che-machine-exec affected versions not specified Description The che-machine-exec service is subject to OS command injection. The service constructs shell commands by concatenating user-controlled input into a double-quoted sh -c...

PT-2026-127877

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext update tmpl function. This makes it possible for unauthenticated attackers...

CVE-2026-118613: Deserialization of Untrusted Data

Ultralytics torchload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118604: Stack-based Buffer Overflow

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. T...

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

CVE-2026-118617: Deserialization of Untrusted Data

Ultralytics loaddatasetcachefile Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must...

VulnCheck KEV: CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

PT-2026-127862

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

Oracle Application Object Library Code Execution

The vulnerability in the Core component of the Oracle Application Object Library for Oracle E-Business Suite enterprise activity automation is related to flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code and gain full contr...

Linux Distros Unpatched Vulnerability : CVE-2026-118340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-118338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-118312

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML pag...