Linux Distros Unpatched Vulnerability : CVE-2026-118327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a...

Linux Distros Unpatched Vulnerability : CVE-2026-118332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker who had compromised the renderer process to potentially execute...

CVE-2026-118613: Deserialization of Untrusted Data

Ultralytics torchload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-118604: Stack-based Buffer Overflow

Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. T...

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attack...

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the...

CVE-2026-118617: Deserialization of Untrusted Data

Ultralytics loaddatasetcachefile Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must...

VulnCheck KEV: CVE-2026-86426

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to...

PT-2026-127862

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the...

Oracle Application Object Library Code Execution

The vulnerability in the Core component of the Oracle Application Object Library for Oracle E-Business Suite enterprise activity automation is related to flaws in the authentication process. Exploitation of this vulnerability enables a remote attacker to execute arbitrary code and gain full contr...

PT-2026-128331

Ultralytics load dataset cache file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target...

PT-2026-128316

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...

PT-2026-128327

Ultralytics torch load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the target must visit a...

PT-2026-128326

Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this...

amule -- multiple vulnerabilities

aMule developers report: A security release first: it fixes 15 vulnerabilities reported through GitHub Security Advisories, and 11 of them are also present in aMule 2.3.3. If you still run 2.3.x or any 3.x release, please upgrade. GHSA-cp82-q55r-936c High: heap off-by-one write and use-after-free...

Ultralytics deserialization injection vulnerability

Version 8.4.65 of Ultralytics contains a deserialization injection vulnerability. This flaw arises because the loaddatasetcachefile function fails to validate user-supplied data, allowing untrusted data to be deserialized. As a result, remote attackers may execute arbitrary code within the contex...

Fastjson 1.2.83 Remote Code Execution

Fastjson versions 1.2.68 through 1.2.83 contain a remote code execution vulnerability when parsing attacker-controlled JSON in a Spring Boot executable fat-JAR. A proof of concept is included. https://packetstorm.news/download/238048...

CVE-2026-58256

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldapfilter, poisoning /personnalisation/configldap.inc.php and permitting remote code...

CVE-2026-118359

Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-118359

Use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...