CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108963

databasement before 1.8.2 allows remote code execution because it runs certain commands e.g., mariadb-dump with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command...

EUVD-2026-97124

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

CVE-2026-108976

GNU Emacs before 31.2 and TRAMP through 2.8.2 allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992...

Exploit for CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated RCE Unaut...

CVE-2026-108963

The databasement software versions prior to 1.8.2 is vulnerable to remote code execution due to argument injection (CWE-88). The application executes commands such as mariadb-dump using a database name that can be supplied by any authenticated user . While the application uses quoting to prevent ...

CVE-2026-108963

databasement before 1.8.2 allows remote code execution because it runs certain commands e.g., mariadb-dump with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command...

EUVD-2026-97123

databasement before 1.8.2 allows remote code execution because it runs certain commands e.g., mariadb-dump with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command...

CVE-2026-108925

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Cohesity NetBackup Administration Console web interface. This issue affects NetBackup Administration Console web interface: versions before 11.2...

CVE-2026-108768

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768 zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108768

A vulnerability exists in zhayujie CowAgent up to version 2.2.0 within the Streaming Tool-Call Argument Handler component. The issue stems from the json.loads function, where specific manipulation leads to an allocation of resources (CWE-770, CWE-400). This flaw can be triggered via a remote atta...

EUVD-2026-97122

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2026-108925

creationtimestamp| type| source ---|---|--- 2026-10-11 18:28:09+00:00| seen| https://infosec.exchange/users/cve/statuses/117423688192565180...

Exploit for Path Traversal in Fortinet Fortimail

No d...

CVE-2026-19740

The Link Layer Control Procedure LLCP implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LLPHYUPDATEIND so that it can later be reused for the host notification when the update instant is reached llcprxnoderetain in...

CVE-2026-19935

The Bluetooth LE host queues received L2CAP connection-oriented channel CoC data for deferred processing through a struct kwork embedded in the channel object lechan-rxwork, handler l2caprxprocess whenever the channel uses a dynamic PSM 0x0080-0x00FF. Channel teardown in l2capchandestroy in...

CVE-2026-59508

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Interuse i-Bos. This issue affects i-Bos: 3.0...

CVE-2026-19739

The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/llsw/ullllcpconnupd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later carry the host notification llcprxnoderetain, which marks it...