CVE-2026-67195

CVE-2026-67195 describes a remote code execution in Perspective 5.0.0 via an eval() expression injection in the PolarsVirtualServer backend. The vulnerability occurs when client-supplied input is passed directly to Python’s eval() with almost no sandboxing (builtins cleared). Attackers can traver...

CVE-2026-67195 Perspective 5.0.0 RCE via eval() Expression Injection

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by daroo in WordPress Plugin CTX Feed versions = 6.6.42...

firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

CVE-2026-16618

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16618 ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

EUVD-2026-52578

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...

CVE-2026-16618

The CVE concerns the WordPress plugin Improve SEO (version up to 2.0.11). The vulnerability arises from improper validation of uploaded files: the plugin checks only the file content type while saving the file with an attacker-supplied extension into a publicly accessible directory. This allows u...

EUVD-2026-52522

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-52527

Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-52536

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

EUVD-2026-52490

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-66321

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66315

Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-62870

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...

Amazon Linux 2023 : cargo-c (ALAS2023-2026-2024)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2024 advisory. gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guar...

Metabase 0.58.x < 0.58.15 / 0.59.x < 0.59.12 / 0.60.x < 0.60.6.3 / 0.61.x < 0.61.1.4 / 1.58.x < 1.58.15 / 1.59.x < 1.59.12 / 1.60.x < 1.60.6.3 / 1.61.x < 1.61.1.4 RCE (CVE-2026-59827)

The version of Metabase installed on the remote host is 0.58.x prior to 0.58.15, 0.59.x prior to 0.59.12, 0.60.x prior to 0.60.6.3, 0.61.x prior to 0.61.1.4, 1.58.x prior to 1.58.15, 1.59.x prior to 1.59.12, 1.60.x prior to 1.60.6.3, or 1.61.x prior to 1.61.1.4. It is, therefore, affected by a...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2025-29296

H3C devices listed (BE18000 V200R007, NX400 V100R015, NX30 Pro V100R0011, R3010 V100R009, NX15 V100R017, R1510 V100R016, NE36 Pro V100R002) expose multiple command injection flaws in the /api/esps handler. Vulnerable interfaces include esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modi...

Important: rust-cargo-c

Issue Overview: gix-submodule before 0.29.0 gitoxide before 0.5.21, gix before 0.84.0 incorrectly validates the update field in .gitmodules, allowing attackers to bypass the CommandForbiddenInModulesConfiguration guard when a submodule has been initialized with only partial configuration in...