164296 matches found
CVE-2026-78861
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
CVE-2026-101919: Improper Input Validation
A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration kubeconfig secrets directly into the privileged control plane namespace without proper validation or sanitization. An authenticated user with cluster and secret creation permissions can exploit...
CVE-2026-0482: Out-of-bounds Write
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This...
CVE-2026-100103: Use of Default Credentials
Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...
CVE-2026-37719
An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...
PT-2026-105997
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
EUVD-2026-92441
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
EUVD-2026-92785
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
CVE-2026-88392
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local. This allows an attacker to execute arbitrary code...
CVE-2026-78861: Memory Allocation with Excessive Size Value
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
ROS-20261005-73-0095
The vulnerability in dotnet9.0 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-78860
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...
PT-2026-104774
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...
CVE-2026-105677: Improper Limitation of a Pathname to a Restricted Directory
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. This issue is fixed in version 6.64.0...
CVE-2026-37719: Deserialization of Untrusted Data
An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...
CVE-2026-100102: Active Debug Code
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server...
CVE-2026-104811: Unrestricted Upload of File with Dangerous Type
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...
CVE-2026-104809: External Control of File Name or Path
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...
CVE-2026-19954
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing ASCII and Cyrillic letters, it skips t...