211374 matches found
PT-2026-76816
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description In the handleException function within lib/setup-sandbox.js, the software fails to sanitize the Error.cause property introduced in ES2022. While the function recursively sanitizes SuppressedError.error,...
EUVD-2026-60358
File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...
PT-2026-76678
UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /create project endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may ...
EUVD-2026-60353
An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file...
PT-2026-76734
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
CVE-2026-50769
The CRM+ application (version 2025.6 and earlier) by Brainformatik has a time-based SQL injection flaw in its CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true), allowing unauthenticated remote attackers to execute arbitrary code. CVSS 3....
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099509)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099509 advisory. Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds...
CVE-2026-50768
T-Systems ImageMaster v9.14.2.8.1 is affected by a file upload vulnerability in the add attachments feature of the "create new document" function, allowing a remote attacker to execute arbitrary code . The CVSS v3.1 score is 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CISA's SSVC ...
FreeBSD : PostgreSQL -- Multiple vulnerabilities (05d311bc-9991-11f1-bc50-6cc21735f730)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05d311bc-9991-11f1-bc50-6cc21735f730 advisory. The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before...
Unity Linux 20.1070e Security Update: gvfs (UTSA-2026-099541)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099541 advisory. A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing...
PT-2026-76872
Name of the Vulnerable Software and Affected Versions PbootCMS version 3.2.15 Description An issue allows an attacker to execute arbitrary code through the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components. Recommendations At the...
CVE-2026-51346
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
CVE-2026-63722
creationtimestamp| type| source ---|---|--- 2026-08-16 15:36:50+00:00| seen| https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8 2026-08-21 00:00:08+00:00| published-proof-of-concept| Telegram/87w5sTCGBPeMw8h3c2UBbBkEJEqeSW1iUUAENsR3qsz5w 2026-08-22 05:10:04+00:00| seen|...
[SECURITY] [DLA 4741-1] unzip security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4741-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura August 16, 2026 https://wiki.debian.org/LTS -...
MINI-MV8V-CG37-XJ75
Bulletin has no description...
EUVD-2026-59911
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...
CVE-2026-17533
The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...
PT-2026-73099
The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...
CVE-2026-74764
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...
CVE-2026-73042
SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitra...