CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

PT-2026-76772

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

EUVD-2026-60536

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

EUVD-2026-60445

An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Parameter in JeecgBoot AI Chat Module...

CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

CVE-2026-38165

A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...

PT-2026-76871

Name of the Vulnerable Software and Affected Versions S2OPC version 1.7.3 Description A heap-based out-of-bounds write occurs during server-side EventFilter handling while processing CreateMonitoredItems. This flaw allows a remote attacker to execute arbitrary code. A heap-based out-of-bounds wri...

PT-2026-73263

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...

CVE-2026-67960

An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components...

CVE-2026-50776

A Directory Traversal vulnerability in Pronis Loisirs Bilttorie CSE (versions before April 2026) allows an unauthenticated remote attacker to read sensitive files and execute arbitrary code. CVSS 3.1 scores it 7.5 (HIGH) with network attack vector, low complexity, and high confidentiality impact....

CVE-2026-67678

DocSys v.2.02.80 (RainyGao-GitHub) has an unauthenticated file upload flaw allowing arbitrary code execution; CISA flags it as automatable with total impact (CVSS 9.8). No patch version is specified in the provided documents. Exploitation details are not provided, though a PoC is referenced in th...

CVE-2026-39255

A buffer overflow in SteelSeries GG v107.0.0 for macOS, located in the libSSEdevice.dylib library's dup_wcs function, allows an unauthenticated remote attacker to execute arbitrary code. CVSS 9.8 (Critical); no patch or exploit code is mentioned in the provided documents.

RHEL 10 : vim (RHSA-2026:55431)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55431 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Arbitrary Code Execution via crafted...

PT-2026-76652

Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.6 Description Unsafe deserialization of untrusted file metadata allows a user with write access to a network share to execute arbitrary code on the Storage Zones Controller...

CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

PT-2026-76633

openssl encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class . mro . subclasses to access system functions and execute arbitrary OS...

CVE-2026-51346

StudIP (learning management system) has a SQL injection in its store() functions, affecting 6.0.x before 6.0.3 and 5.4.x before 5.4.12. CVSS 9.1 (network, no auth) allows unauthenticated remote attackers to execute arbitrary code and exfiltrate data. CISA SSVC flags it as PoC, automatable, total ...

PT-2026-76860

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description An integer overflow occurs during image processing, which may lead to arbitrary code execution. This issue was addressed by...

CVE-2026-38165

CVE-2026-38165 is a Critical (CVSS 9.8) Server-Side Template Injection (SSTI) vulnerability in OpenSAGRES XDocReport versions 0.9.2 through 2.2.0 , specifically in the fr.opensagres.xdocreport.template.velocity component. When processing DOCX templates with the Apache Velocity engine, a crafted t...