125120 matches found
The vulnerability of the Apache Tomcat application server, related to insufficient input validation, allows attackers to execute arbitrary code.
The vulnerability of the Apache Tomcat application server is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-38165
A Server-Side Template Injection SSTI vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression...
PT-2026-76878
Name of the Vulnerable Software and Affected Versions xdocreport versions 0.9.2 through 2.2.0 Description A Server-Side Template Injection SSTI issue exists in the Velocity template engine configuration. This allows attackers to execute arbitrary code by providing a crafted expression. SSTI is a...
PT-2026-76817
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description A sandbox breakout allows code running within the environment to escape and execute arbitrary commands on the host system. The issue occurs because lib/bridge.js and lib/setup-sandbox.js fail to block...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099466)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099466 advisory. Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099526)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099526 advisory. Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before...
EUVD-2026-60353
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file...
CVE-2026-39255
Buffer Overflow vulnerability in SteelSeries GG macOS v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dupwcs components...
CVE-2026-50771
Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...
CVE-2026-50769
The CRM+ application (version 2025.6 and earlier) by Brainformatik has a time-based SQL injection flaw in its CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true), allowing unauthenticated remote attackers to execute arbitrary code. CVSS 3....
CVE-2026-67919
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components...
CVE-2026-50776
Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...
CVE-2026-67854
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...
CVE-2026-67961
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution...
CVE-2026-67961
An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution...
CVE-2026-67854
SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...
PT-2026-76734
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
CVE-2026-67967
CVE-2026-67967 is a buffer overflow (CWE-121) and command injection (CWE-78) in the /goform/module API of Tenda W20E V5.0 firmware V16.01.0.6(2782). The vendor's prior fix (CVE-2025-44867, CVE-2026-36819) left sibling handlers vulnerable: setFixTools.hostName filters only ;, &, | before popen()-e...
Unity Linux 20.1070e Security Update: gvfs (UTSA-2026-099541)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099541 advisory. A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing...
