Lucene search
+L

121831 matches found

Cvelist
Cvelist
added yesterday19 views

CVE-2026-52656

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file...

Exploits0References2
NVD
NVD
added 2 days ago7 views

CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

7.8CVSS0.00204EPSS
Exploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-12484

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

7.8CVSS8.2AI score0.00204EPSS
Exploits0References2
NVD
NVD
added 3 days ago10 views

CVE-2026-12228

A stored cross-site scripting XSS vulnerability exists in the POST /api/prompts/share endpoint of parisneo/lollms latest version. The endpoint stores attacker-controlled promptcontent into DBDirectMessage.content without server-side sanitization. When a victim opens the direct message DM thread,...

8.7CVSS0.00261EPSS
Exploits0References1
Nuclei
Nuclei
added 3 days ago86 views

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

8.8CVSS8.9AI score0.99077EPSS
Exploits24References5
CVE
CVE
added 4 days ago62 views

CVE-2026-48062

Summary: CodeIgniter versions before 4.7.3 are affected by a validation bypass in the ext_in upload rule. The rule checks the MIME-derived guessed extension instead of the client-provided filename extension, allowing a file like shell.php (with GIF-like content) to pass validation when the upload...

9.8CVSS6AI score0.00444EPSS
Exploits0References3
Cvelist
Cvelist
added 4 days ago30 views

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

9.8CVSS0.00444EPSS
Exploits0References3
OSV
OSV
added 4 days ago4 views

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

9.8CVSS6AI score0.00444EPSS
Exploits0References5
NVD
NVD
added 4 days ago6 views

CVE-2026-48373

Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS0.00186EPSS
Exploits0References1
NVD
NVD
added 4 days ago7 views

CVE-2026-14501

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

4.3CVSS0.00332EPSS
Exploits0References1
EUVD
EUVD
added 4 days ago10 views

EUVD-2026-45305

IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0 could allow an attacker to execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions...

4.3CVSS5.9AI score0.00332EPSS
Exploits0References1
CVE
CVE
added 4 days ago13 views

CVE-2026-14501

CVE-2026-14501 affects IBM Db2 Genius Hub 1.1, 1.1.1, 1.1.2 and IBM Agentics 1.0. The root cause is the use of potentially dangerous functions without sufficient restrictions, which could allow an attacker to execute arbitrary code or obtain sensitive information. According to the CVSS v3.1 metri...

4.3CVSS6AI score0.00332EPSS
Exploits0References1
CVE
CVE
added 4 days ago11 views

CVE-2026-48373

CVE-2026-48373 describes a heap-based buffer overflow in Acrobat Reader that could allow arbitrary code execution in the context of the current user. The vulnerability requires user interaction (victim opens a malicious file); no vector details are provided beyond this condition. The affected pro...

7.8CVSS6.1AI score0.00186EPSS
Exploits0References1
EUVD
EUVD
added 4 days ago10 views

EUVD-2026-45290

Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS6.1AI score0.00186EPSS
Exploits0References1
Cvelist
Cvelist
added 4 days ago41 views

CVE-2026-48373 Acrobat Reader | Heap-based Buffer Overflow (CWE-122)

Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

7.8CVSS0.00186EPSS
Exploits0References1
Cvelist
Cvelist
added 4 days ago34 views

CVE-2026-8635 Arbitrary Code Execution in Python Interpreter Component

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions...

9.9CVSS0.00288EPSS
Exploits0References1
CVE
CVE
added 4 days ago23 views

CVE-2026-8635

Security bulletin confirms CVE-2026-8635 affects Langflow OSS versions 1.0.0–1.10.0 where an authenticated user can exploit the Python Interpreter component to execute arbitrary code, bypass controls, and escalate to superuser by manipulating the database, potentially compromising the Langflow se...

9.9CVSS5.7AI score0.00288EPSS
Exploits0References1Affected Software1
NVD
NVD
added 4 days ago9 views

CVE-2026-57860

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

8.4CVSS0.00134EPSS
Exploits0References5
Vulnrichment
Vulnrichment
added 4 days ago10 views

CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

8.4CVSS5.9AI score0.00134EPSS
Exploits0References5
OSV
OSV
added 4 days ago4 views

CVE-2026-57860 ForgeCode Arbitrary Code Execution via Unvetted .mcp.json in Untrusted Repository

ForgeCode tailcallhq/forgecode, an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mcp.json file on startup without user confirmation. A malicious repository can supply a crafted .mcp.json whose mcpServers entries specify arbitrary command and...

8.4CVSS5.9AI score0.00134EPSS
Exploits0References7
Rows per page
Query Builder