PT-2026-76878

Name of the Vulnerable Software and Affected Versions xdocreport versions 0.9.2 through 2.2.0 Description A Server-Side Template Injection SSTI issue exists in the Velocity template engine configuration. This allows attackers to execute arbitrary code by providing a crafted expression. SSTI is a...

PT-2026-76744

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

PT-2026-76864

Name of the Vulnerable Software and Affected Versions Qcms version 6.0.6 Description An SQL Injection issue allows a remote attacker to execute arbitrary code. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthoriz...

PT-2026-76812

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099502 advisory. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operati...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099526)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099526 advisory. Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099466 advisory. Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client...

The vulnerability of the Apache Tomcat application server, related to insufficient input validation, allows attackers to execute arbitrary code.

The vulnerability of the Apache Tomcat application server is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-39255

Buffer Overflow vulnerability in SteelSeries GG macOS v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dupwcs components...

CVE-2026-67961

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution...

CVE-2026-67854

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code...

PT-2026-76872

Name of the Vulnerable Software and Affected Versions PbootCMS version 3.2.15 Description An issue allows an attacker to execute arbitrary code through the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components. Recommendations At the...

CVE-2026-50773

An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file...

PT-2026-76816

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description In the handleException function within lib/setup-sandbox.js, the software fails to sanitize the Error.cause property introduced in ES2022. While the function recursively sanitizes SuppressedError.error,...

EUVD-2026-60358

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

PT-2026-76678

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /create project endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may ...

EUVD-2026-60353

An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file...

PT-2026-76734

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-50769

The CRM+ application (version 2025.6 and earlier) by Brainformatik has a time-based SQL injection flaw in its CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true), allowing unauthenticated remote attackers to execute arbitrary code. CVSS 3....