MLflow code injection vulnerability

MLflow versions 3.12.0rc0 through 3.17.0 contain a code injection vulnerability. This vulnerability stems from a third-party scorer deserializing a module specified by the user via the MLflow /genai/scorers/base.py endpoint; instead of using the exact allowed modules, it uses the...

VulnCheck KEV: CVE-2026-84999

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the pieregfileupload function. This is due to the plugin performing file type validation via wpcheckfiletype and wpcheckfiletypeandext but never checking...

Google Chrome Vulnerability: CVE-2026-118342

Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-78845: Undefined Security Weakness

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

Google Chrome Vulnerability: CVE-2026-118336

Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

WordPress Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution vulnerability

Authenticated Contributor+ PHP Object Injection to Remote Code Execution vulnerability discovered by moochi in WordPress Plugin Rank Math SEO versions = 1.0.276...

Google Chrome Vulnerability: CVE-2026-118304

Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Google Chrome Vulnerability: CVE-2026-118321

Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

PT-2026-126615

Name of the Vulnerable Software and Affected Versions Aidot Linkind Matter Smart Plug version 1.01.32 OREiN Matter Smart Light Bulb version 3.15.21 Linkind Wi-Fi Smart Light Bulb version 3.30.17 Description Remote Code Execution RCE is possible due to an issue in the UPnP root description parsing...

PT-2026-127234

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-57200: asterisk, certified-asterisk: Asterisk is an open source private branch exchange and telephony toolkit

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the Asterisk REST Interface ARI may, under certain conditions, execute write...

PHP 8.5.11 Remote Code Execution

PHP version 8.5.11 contains an out-of-memory handling flaw that can result in remote code execution. The included proof of concept targets Apache modphp prefork deployments using multipart requests and session-state disclosure. https://packetstorm.news/download/237867...

Google Chrome Vulnerability: CVE-2026-118307

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

TencentOS Server 3: php:8.2 (TSSA-2026:1209)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1209 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Security Update for Microsoft .NET Core (October OOB 2026)

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network. CVE-2026-70197 -...

Google Chrome Vulnerability: CVE-2026-118348

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Google Chrome Vulnerability: CVE-2026-118353

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

Microsoft Edge (Chromium-based) buffer error vulnerability

A buffer error vulnerability exists in Microsoft Edge Chromium-based versions from 1.0.0.0 up to and including 154.0.4258.48. This vulnerability stems from using an incompatible type to access resources a type confusion, potentially allowing unauthorized attackers to execute code over the network...

Google Chrome resource management error vulnerability

Google Chrome versions prior to 156.0.8078.73 contain a resource management error vulnerability. This vulnerability stems from a post-free reuse issue in FileSystem, which may allow remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...