EUVD-2026-69707

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...

CVE-2026-84326

An uninitialized resource flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=547936520 Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi...

Sangoma Switchvox SQL Injection Vulnerability

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution...

RockyLinux 8 : gimp:2.8 (RLSA-2026:62507)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:62507 advisory. gimp: gimp: Stack buffer overflow in pnmscannergettoken CVE-2026-58380 gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on...

PT-2026-84865

Name of the Vulnerable Software and Affected Versions Windows ML CLI versions prior to 0.4.0 Description The src/winml/modelkit/serve/cli api.py component exposes commands through a localhost HTTP API without authentication and uses a wildcard for the allow origins setting. This allows a maliciou...

AppNitro MachForm 30 Shell Upload

AppNitro MachForm version 30 suffers from a remote shell upload vulnerability. CVE-2026-78839 Description An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. Successful exploitation of this issue requires t...

The vulnerability of the http.cookies.Morsel.jsOutput() method in the Python programming language interpreter (CPython) allows a hacker to execute arbitrary code. [source-iocs-preserved method=http.cookies.Morsel.js_output()]

The vulnerability of the http.cookies.Morsel.jsOutput method in the Python programming language interpreter CPython is related to incorrect encoding or escaping of output data. Exploiting this vulnerability can allow a remote attacker to exploit the system. source-iocs-preserved...

SonicWall SMA1000 Appliances OS Command Injection Vulnerability

SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution...

...[ More ]

This Metasploit module exploits CVE-2026-48558 to forge an OpenID Connect identity token and obtain a SimpleHelp technician session. It then uses SimpleHelps legitimate remote access WebSocket protocol to connect to an online managed machine and execute a payload through the remote terminal. An...

PT-2026-84768

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.580 Jenkins LTS versions prior to 2.568.3 Description Objects that store their configuration in independent top-level configuration files, such as jobs and global configuration, can be smuggled as nested field value...

Linux Distros Unpatched Vulnerability : CVE-2026-66047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers...

ROS-20260902-73-0025

The vulnerability in PHP is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260902-73-0027

The vulnerability in PHP is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260902-73-0026

The vulnerability in PHP is related to overflow of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Deserialization vulnerability

Jenkins uses serialization and deserialization to load and save configuration and build data using XStream. Types storing their configuration in their own files usually config.xml or build.xml, like agents, items, or builds, are indicated as such by implementing the Java interface PersistenceRoot...

CVE-2026-84333

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84333

CVE-2026-84333 is a use-after-free vulnerability in Dawn , a graphics abstraction component of Google Chrome , affecting versions prior to 152.0.7977.75 on Android (and 152.0.7977.76 on Windows/Mac). A remote attacker can execute arbitrary code outside the sandbox by serving a crafted HTML page, ...

CVE-2026-84326

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-83549

Post-authentication Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability has been identified in the SMA1000 Appliance Management Console AMC which in specific conditions could potentially enable a remote authenticated attacker as administrator to...