234789 matches found
PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...
lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection
A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...
lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href
A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...
dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection
A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection SSTI vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote attacker could exploit this by embedding malicious template...
GitPython: GitPython: Arbitrary code execution via improper validation of clone options
A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the clone function. By crafting a malicious string in the multioptions parameter, an attacker could bypass validation. This allows for the...
foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
[SECURITY] [DLA 4811-1] chromium security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4811-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...
[SECURITY] [DLA 4810-1] thunderbird security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4810-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 02, 2026 https://wiki.debian.org/LTS -...
CVE-2026-51886
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed...
DEBIAN-CVE-2026-103484
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...
CVE-2026-103484
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...
CVE-2026-0848
CVE-2026-0848 — NLTK StanfordSegmenter: 信頼できないJARの読み込みによる任意コード実行 -red?style=for-the-badge -brightgreen?style=for-the-badge 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2026-0848 パッケージ| nltk Natural Language Toolkit レジストリ| PyPI 影響を受けるバージョン| = 3.9.2 脆弱性タイプ| CWE-20: 不適切な入力検証 CVSSスコア| 10.0 Critical 攻撃元区分| ネットワーク...
EUVD-2026-91054
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
CVE-2026-55251 NetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules Files
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI workflow .github/workflows/validation.yml runs on pullrequest and executes code supplied by the pull request before any maintainer review. Three...
CVE-2026-103484 pgvector buffer overflow in IVFFlat index build
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...
CVE-2026-103484
A flaw in pgvector before version 0.8.7 allows an authenticated database user to trigger an out-of-bounds write during an Inverted File Flat (IVFFlat) index build operation. This vulnerability can lead to arbitrary code execution or a crash resulting in a denial of service on the database server....