RHEL 8 : vim (RHSA-2026:11509)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:11509 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: arbitrary command execution via modeline sandbox bypass...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32755)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability arises from the setIptvCfg function failing to properly validate the command parameters entered by users. Attacker...

libpng: libpng: Arbitrary code execution due to use-after-free vulnerability

A flaw was found in libpng, a library used for processing PNG Portable Network Graphics image files. This vulnerability arises from improper memory management where a heap-allocated buffer is aliased between internal data structures. When specific functions are called, a freed memory region can...

TOTOLINK A3300R stunEnable Parameter Command Injection Vulnerability

The TOTOLINK A3300R is a wireless router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK A3300R stunEnable parameter, which stems from the cstecgi.cgi file failing to properly handle the stunEnable parameter and can be exploited by an attacker to...

mathjs 安全漏洞

MathJS is an extension library for JavaScript and Node.js developed by Jos de Jong the individual developer. It includes a flexible expression parser, offering integrated solutions for handling numbers, large numbers, complex numbers, units, matrices, etc. Versions of MathJS from 13.1.1 to 15.2.0...

CVE-2026-38834

Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the dopingaction function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Terrarium contains a vulnerability that allows arbitrary code execution

Overview Terrarium is a sandbox-based code execution platform that enables users to run and execute code in a controlled environment, providing a secure way to test and validate code. However, a vulnerability has been discovered in Terrarium that allows arbitrary code execution with root privileg...

CVE-2026-35682

The CVE-2026-35682 vulnerability affects Anviz CX2 Lite. An authenticated attacker can inject commands via a filename parameter, enabling arbitrary command execution and root-level access (example: starting telnetd). The available connected sources confirm the affected product and the root-level ...

PT-2026-33409

An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product...

SQL Injection

Overview @saltcorn/data is a Data models for Saltcorn, open-source no-code platform Affected versions of this package are vulnerable to SQL Injection via the getSyncRows and getDelRows functions. An attacker can execute arbitrary SQL commands, exfiltrate sensitive data, modify or delete database...

PT-2026-33071

Name of the Vulnerable Software and Affected Versions LangChain-ChatChat version 0.3.1 Description An issue exists in the MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface to configure an MCP STDIO server using...

Arbitrary Code Injection

Overview metagpt is a The Multi-Agent Framework Affected versions of this package are vulnerable to Arbitrary Code Injection via the xmlfill function of the XML Handler. An attacker can execute arbitrary code by injecting malicious input that is improperly neutralized in dynamically evaluated cod...

CVE-2026-33088

Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement...

CVE-2026-39624

CVE-2026-39624 affects the WordPress Kutethemes Biolife theme (

Six Apart Movable Type SQL注入漏洞

Six Apart Movable Type is an application system developed by the Six Apart company in the United States. It offers features such as multi-user support, comments, Trackbacks, and themes. Six Apart Movable Type has a SQL injection vulnerability; this vulnerability makes it susceptible to SQL...

CVE-2026-35021

...

CVE-2026-34779

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder used an AppleScript fallback path that did not properly handle certain characters in the...

CVE-2026-34940

KubeAI has a OS Command Injection vulnerability in the Ollama Engine startup probe. Before version 0.23.2, the ollamaStartupProbeScript() constructs a shell command via fmt.Sprintf using unsanitized model URL components (ref, modelParam) and runs it with bash -c as a Kubernetes startup probe. An ...

CVE-2026-5463

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

CVE-2026-35053

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId without any authentication middleware. An attacker who ca...