com.mchange/mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection

A flaw was found in mchange-commons-java, a Java utility library. This vulnerability allows a remote attacker to achieve arbitrary code execution through Java Naming and Directory Interface JNDI injection. The library's JNDI ObjectFactory can construct objects of arbitrary classes and initialize...

CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry

rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...

CVE-2026-27544

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27380

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)

UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...

CVE-2026-27544

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

EUVD-2026-57939

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27544 WordPress QA Analytics plugin <= 5.2.0.0 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...

CVE-2026-27544

CVE-2026-27544 affects the WordPress QA Analytics plugin (versions ≤ 5.2.0.0). It enables unauthenticated Remote Code Execution via a flaw described in multiple sources. The provided documents do not specify the root cause, affected component details beyond the plugin/version, or a confirmed reme...

Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...

CVE-2026-49827

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

ALPINE-CVE-2026-16239

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

CVE-2026-14662

The CVE-2026-14662 entry describes an integer wraparound in PostgreSQL tsvector/tsquery data type functions, allowing an unprivileged database user to cause undersized allocations and out-of-bounds writes via crafted inputs. Consequences stated include potential arbitrary code execution as the op...

EUVD-2026-57830

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-49827 WebErpMesv2 has Unauthenticated RCE via Unrestricted File Upload in HR Expense scan_file (CWE-434)

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

DEBIAN-CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CVE-2026-73601

Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node when CUSTOMMCPPROTOCOL is set to stdio, allowing authenticated users to execute arbitrary commands by manipulating environment variables and command arguments. Attackers can abuse PYTHONWARNINGS and...

UBUNTU-CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clonefrom, fetch, pull, push, lsremote, itercommit...

CLEANSTART-2026-IJ26025 Security fixes in metrics-server 0.8.1-r3

Package metrics-server version 0.8.1-r3 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42151, CVE-2026-42154...