166654 matches found
Improper Neutralization of Special Elements Used in a Template Engine
Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the email template field. An attacker can execute arbitrary code on the server by submitting a specially crafted payload. Remediation Upgrade...
CVE-2026-75357
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...
CVE-2026-54718
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...
GHSA-G8WR-R2V2-VQC6 silverstripe/userforms vulnerable to remote code execution via userforms email subject
Impact The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server. Reported by Jack Wallace from Bastion Security...
CVE-2026-54721
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
CVE-2026-81719
opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...
CVE-2026-81701 openssl_encrypt before 1.4.9 Arbitrary Code Execution via unsigned plugin
opensslencrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths...
CVE-2026-16238
A flaw was found in PostgreSQL. An object creator can exploit a type confusion vulnerability in the pgrestoreattributestats function. This flaw occurs due to the conflation of range and multirange values, allowing the attacker to execute arbitrary code as the operating system user running the...
CVE-2026-76226
A flaw was found in Renovate. This vulnerability affects the bazel-module and bazelisk managers when processing lockFileMaintenance. A remote attacker can exploit this by providing malicious dependencies, leading to the execution of arbitrary code. This occurs when these dependencies are referenc...
CVE-2026-59894
A flaw was found in sqlparse, a non-validating SQL parser module for Python. When generating Python or PHP code snippets, the sqlparse.format function fails to properly escape backslashes before quotes in SQL strings. This vulnerability allows a local attacker, by providing crafted SQL, to break...
USN-8684-1: Perl vulnerabilities
It was discovered that Perl incorrectly handled certain arguments to Socket and pack/unpack functions. An attacker could possibly use this issue to read sensitive information from memory. CVE-2026-12087, CVE-2026-57432 It was discovered that Perl incorrectly handled regular expressions with a lar...
[SECURITY] [DSA 6474-1] cockpit security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6474-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 27, 2026 https://www.debian.org/security/faq -...
Exploit for CVE-2010-1240
Vulnerabilities, Exploits, and Remote Access Payloads — lab wr...
vulnerabilities present in Microsoft Office
Microsoft has identified vulnerabilities in various Office products. A malicious individual can exploit these vulnerabilities to carry out attacks that can cause damage as described in the following table. For successful exploitation, the malicious individual must deceive the victim into opening ...
CVE-2026-80571
A flaw was found in the Linux kernel's powerpc/pseries: papr-phy-attest component. This vulnerability arises from insufficient validation of a command length parameter, which can lead to a buffer overflow. Such an overflow could be exploited by a local attacker to potentially execute arbitrary co...
libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow
A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially...
Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is vulnerable to stored cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server is used by IBM Tivoli System Automation Application Manager and is vulnerable to cross-site scripting and deserialization vulnerabilities. Required fixes for affected WebSphere Application Server has been published in the security bulletin links below...
CVE-2026-19225
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
CVE-2026-19223
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
EUVD-2026-66874
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...