212461 matches found
CVE-2026-81302
PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...
[SECURITY] [DLA 4770-1] firefox-esr security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4770-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 04, 2026 https://wiki.debian.org/LTS -...
CVE-2026-85197
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle MITM attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file bod...
CVE-2026-19224
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
EUVD-2026-70902
The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
CVE-2026-79675
A flaw was found in NLTK. When processing untrusted input for its per-call options parameter in the java function, NLTK fails to validate Java Virtual Machine JVM options. A remote attacker could exploit this by injecting dangerous JVM flags, such as -agentpath or -javaagent, to achieve arbitrary...
kernel: crypto: qat - validate RSA CRT component lengths
A flaw was found in the Linux kernel's QAT QuickAssist Technology crypto module. This vulnerability occurs in the RSA key parser when handling CRT Chinese Remainder Theorem components. An underflow can happen during a memory copy operation if an RSA CRT component is larger than its allocated...
kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation
A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...
CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
EUVD-2026-71745
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...
CVE-2025-67066
SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...
...[ More ]
Arbitrary code execution is possible in the MQTTVersion utility of Paho version 1.3.15 due to unsafe loading and execution of untrusted shared libraries. When a user supplies a shared library path as a command-line argument, the application loads the library using dlopen and resolves an exported...
PT-2026-85685
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
PT-2026-85565
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...
CVE-2026-78849
A Cross-Site Scripting (XSS) vulnerability in Netgate pfSense Plus (versions ≤ 26.03) and pfSense CE (versions ≤ 2.8.1) allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file. The vulnerability is rated CVSS 3.1: 5.4 (MEDIUM) with a network vector, low co...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...
Debian dsa-6483 : thunderbird - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6483 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6483-1 [email protected] https://www.debian.org/securit...
CVE-2026-50894
easyadmin v2.0.2.2 is affected by an Unrestricted Upload of File with Dangerous Type vulnerability in its background management interface . An authenticated remote attacker can upload a crafted file to execute arbitrary code and gain server-level privileges . The flaw is rated CVSS 9.8 (CRITICAL)...
CVE-2025-67066
A SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote, unauthenticated attacker to execute arbitrary code by manipulating the outtype parameter in the /outaddresspaging path. The CNA-assigned CVSS v3.1 score is 9.8 (Critical) , reflecting network reachability with low complexit...