166328 matches found
CVE-2026-95182
A vulnerability in DeepSeek Harness (dsh) , specifically in commit c291e796 , involves an untrusted search path (CWE-426). This flaw allows an attacker to achieve arbitrary code execution by supplying and opening crafted executable files that replace legitimate content. The impact is rated as CRI...
Adobe ColdFusion 2023.x < 2023 Update 26 / 2025.x < 2025 Update 14 Multiple Vulnerabilities (APSB26-144)
The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 26 or 2025.x update 14. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-144 advisory. - ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type...
EUVD-2026-102905
Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository...
Amazon Linux 2023 : mount-s3 (ALAS2023-2026-3233)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3233 advisory. Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client...
Adobe Substance 3D Designer <= 16.0.5 Multiple Vulnerabilities (APSB26-169)
The version of Adobe Substance 3D Designer installed on the remote host is prior or equal to 16.0.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-169 advisory. - Substance3D - Designer is affected by an out-of-bounds write vulnerability that could result in...
PT-2026-115616
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...
MiracleLinux 8 : flatpak-1.12.9-7.el8_10 (AXSA:2026-2074:06)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2074:06 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via...
CVE-2026-111458: Heap-based Buffer Overflow
The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...
CVE-2026-95182
An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...
EUVD-2026-102903
An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...
CVE-2025-52097
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...
Debian dla-4838 : chromium - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4838 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4838-1 [email protected]...
Adobe Substance 3D Sampler < 6.0.4 Multiple Vulnerabilities (APSB26-159)
The version of Adobe Substance 3D Sampler installed on the remote host is prior or equal to 6.0.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-159 advisory. - Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in...
CVE-2026-95182: Untrusted Search Path
An untrusted search path in DeepSeek Harness dsh commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content...
Microsoft Excel Code Execution
The vulnerability of Microsoft Excel spreadsheet editors within the Microsoft Office and Microsoft 365 Apps for Enterprise software packages is related to reading data beyond the allowed range in memory. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...
FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of FreeBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the FIOSSHMLPGCNF...
CVE-2025-52097
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...
Debian dsa-6566 : expat - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6566 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6566-1 [email protected] https://www.debian.org/securit...
CVE-2026-15176
A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to...
CVE-2026-92777
A potential vulnerability exists in some Lenovo Tablets that could allow an attacker with physical access to an unlocked device to bypass device protections and execute arbitrary code . The underlying cause is associated with the use of a default cryptographic key (CWE-1349). No specific exploit ...