248576 matches found
The vulnerability of the MongoDB database management system, related to integer overflows, allows attackers to execute arbitrary code.
The vulnerability of the MongoDB database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
...[ More ]
A stack-based buffer overflow vulnerability exists in the htpasswd utility bundled with thttpd. The vulnerability occurs due to unsafe copying of a user-supplied command-line argument into a fixed-size stack buffer without proper bounds checking.Specifically, the program copies the username...
PT-2026-89188
Уязвимость прикладного программного интерфейса программных платформ для разработки и управления онлайн магазинами Magento Open Source, Adobe Commerce и Adobe Commerce B2B связана с непринятием мер по нейтрализации специальных элементов в механизме создания шаблонов. Эксплуатация уязвимости может...
CVE-2026-85197: Use After Free
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
Debian dsa-6483 : thunderbird - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6483 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6483-1 [email protected] https://www.debian.org/securit...
PT-2026-85408
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created HTML page...
MiracleLinux 9 : wget-1.21.1-11.el9_8 (AXSA:2026-1757:02)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1757:02 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution...
PT-2026-85685
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
CVE-2026-50894
The software easyadmin v2.0.2.2 is vulnerable to an Unrestricted Upload of File with Dangerous Type within its background management interface. This flaw allows authenticated remote attackers to upload a crafted file, leading to arbitrary code execution and the acquisition of full server privileg...
CVE-2025-67066
SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...
CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...
ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...
aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...
gitpython: GitPython: Arbitrary code execution via config-name injection
A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code...
GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration
A flaw was found in GitPython, a Python library used to interact with Git repositories. The GitConfigParser.setvalue function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious configuration settings, specifically the core.hooksPath, into a Gi...
Important: Red Hat Security Advisory: Satellite 6.19.4 Async Update
A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...