CVE-2025-67066

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

CVE-2026-85197: Use After Free

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...

CVE-2026-78849

A Cross Site Scripting (XSS) vulnerability exists in Netgate pfSense Plus software (versions <= 26.03) and pfSense CE software (versions

CVE-2026-50894

The software easyadmin v2.0.2.2 is vulnerable to an Unrestricted Upload of File with Dangerous Type within its background management interface. This flaw allows authenticated remote attackers to upload a crafted file, leading to arbitrary code execution and the acquisition of full server privileg...

Debian dsa-6483 : thunderbird - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6483 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6483-1 [email protected] https://www.debian.org/securit...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

CVE-2026-85610: Improper Control of Generation of Code

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

CVE-2025-67066

A SQL Injection vulnerability exists in oasys sysoa version 1.0 . A remote attacker can exploit the outtype parameter within the /outaddresspaging path to execute arbitrary code. The vulnerability has a CRITICAL base severity score of 9.8, with high impact on confidentiality, integrity, and avail...

CVE-2026-85694: Improper Control of Generation of Code

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extractasobject that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pages using indirect prompt injection to execute...

PT-2026-86246

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

...[ More ]

A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username...

EUVD-2026-71711

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

The vulnerability of the MongoDB database management system, related to integer overflows, allows attackers to execute arbitrary code.

The vulnerability of the MongoDB database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

MiracleLinux 9 : wget-1.21.1-11.el9_8 (AXSA:2026-1757:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1757:02 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution...

CVE-2026-11613: Improper Control of Filename for Include/Require Statement in PHP Program

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'customlooptemplate' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing th...

CVE-2026-81302: Incorrect Default Permissions

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2025-67066: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

PT-2026-85408

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-67397: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

The vulnerability of the TableNG component of the Grafana monitoring and observation platform allows a hacker to execute arbitrary code.

The vulnerability of the TableNG component of the Grafana monitoring and observation platform is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...