166669 matches found
PT-2026-82550
Name of the Vulnerable Software and Affected Versions Bilibili Desktop version 1.17.9 Description A remote attacker can execute arbitrary code through the bili-inject.js and bili-bridge.js components. Recommendations At the moment, there is no information about a newer version that contains a fix...
CVE-2026-54718: Improper Neutralization of Special Elements Used in a Template Engine
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...
CVE-2026-47875: Deserialization of Untrusted Data
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an...
CVE-2026-18885: Improper Control of Generation of Code
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond...
PT-2026-85197
openssl encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...
PT-2026-82614
Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient controls during the execution of untrusted third-party plugins allow for arbitrary code execution with the privileges of the user running the software. This occurs because the...
PT-2026-82652
Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description A code injection issue exists in the ServiceNow AI platform. This flaw allows an unauthenticated user to execute arbitrary code, potentially enabling unauthorized access to or...
CVE-2026-6876: Improper Control of Generation of Code
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than...
CVE-2026-75357
An issue in Bilibili Desktop v.1.17.9 allows a remote attacker to execute arbitrary code via the bili-inject.js and bili-bridge.js components...
PT-2026-82650
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpointer.recover if possible. Attackers can...
CVE-2026-75357
Bilibili Desktop v.1.17.9 is affected by a vulnerability that allows a remote attacker to achieve arbitrary code execution . The root cause involves the bili-inject.js and bili-bridge.js components. The issue is categorized as an Improper Control of Generation of Code . No specific remediation st...
CVE-2026-54721: Improper Control of Generation of Code
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user wit...
Debian dsa-6473 : libdbi-perl - security update
The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6473 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6473-1 [email protected] https://www.debian.org/securit...
Tenda CH22 Router Command Execution
The vulnerability of the formexeCommand function in the Tenda CH22 router’s microprogramming system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
GitPython Submodule Config Code Execution
The vulnerability of the Submodule.config parser function in the Python library for interacting with Git repositories in GitPython is related to incorrect external management of file names or paths. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Tenda CH22 Router Code Execution
The vulnerability of the formeditFileName function in the Tenda CH22 router’s software lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
RPM getTarSpec Code Execution
The vulnerability of the getTarSpec function in the tools/rpmbuild.cc component of the RPM package manager is related to improper code generation. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
SQLite Driver Code Execution
The vulnerability of the SQLite driver software used by Adminer for database management involves improper code generation practices. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
EUVD-2026-67256
An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...
