263169 matches found
Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
JetBrains is urging customers of on-premise versions of TeamCity to update to the latest version following the discovery of a critical security issue that could result in arbitrary code execution. The vulnerability, assigned CVE-2026-63077 CVSS score: 9.8, affects all TeamCity On-Premises version...
gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation 4 blocksamples channels in gstwavpackdechandleframe causes a very small heap allocation. The WavPack library then writes...
CVE-2026-11756 Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution...
CVE-2026-11756
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution...
CVE-2026-16585
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...
WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by daroo in WordPress Theme Betheme versions = 28.4.2...
CVE-2026-16421
A flaw was found in chromium-browser's WebAudio component. This inappropriate implementation allows a remote attacker to execute arbitrary code within a sandbox by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized actions or further compromise of the system...
CVE-2026-16418
A flaw was found in Chromium. A stack buffer overflow vulnerability in the V8 JavaScript engine allows a remote attacker to execute arbitrary code within the browser's sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page, potentially leading to a complete...
CVE-2026-16420
A flaw was found in the WebAudio component of Google Chrome. A remote attacker could exploit a type confusion vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation would allow the attacker to execute arbitrary code within the browser's sandbox, potential...
EUVD-2026-49697
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...
CraftCMS - Remote Code Execution
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity...
megaco: Erlang/OTP Megaco Flex Scanner: Remote code execution or denial of service via oversized message
A flaw was found in the Erlang/OTP megaco flex scanner C driver. A remote, unauthenticated attacker can exploit a buffer overflow vulnerability by sending a specially crafted H.248/Megaco message with an oversized property parameter name. This can lead to memory corruption, potentially allowing f...
PT-2026-65510
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed ps ptr heap buffer when constructing HT...
PT-2026-65511
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the htmlToUTF8 HTML entity decoding function. The function parses attacker-controlled malicious HTML entities and uses memmove and memcpy to rearrange string content without validating buffer remaining size and...
CVE-2026-51269
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51270
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Linux Distros Unpatched Vulnerability : CVE-2026-51297
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by...
PT-2026-65725
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Repository writers can execute arbitrary shell commands as the Gitea service account by planting a malicious Git hook. On instances with default configurations, external users can register,...
ROS-20260728-73-0010
The vulnerability of the Jolokia application programming interface of the Apache ActiveMQ messaging broker is related to deficiencies in the code generation management mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a configuration XML file...
