455392 matches found
EUVD-2026-95329
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...
EUVD-2026-95346
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
EUVD-2026-95336
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory...
EUVD-2026-95339
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...
EUVD-2026-95332
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...
Malicious code in pxnpm (npm)
pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...
PT-2026-109276
Name of the Vulnerable Software and Affected Versions x64dbg-MCP Server versions prior to 1.1 Description x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes debugger functionality over HTTP and Server-Sent Events SSE. The server listens on 0.0.0.0 by default...
CVE-2026-107824: Missing Authentication for Critical Function
x64dbg-MCP Server is a native Model Context Protocol MCP plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated...
CVE-2026-78796
The Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router (v1.3.241114.024540 and before) contains a vulnerability that allows a remote attacker to perform arbitrary code execution . The flaw is located in the www extbackslash cgi-bin\upgrade file. No specific remediation or explo...
PT-2026-109323
Name of the Vulnerable Software and Affected Versions Aegisub versions 3.2.0 through 3.4.2 Description Aegisub automatically loads Automation scripts referenced by the Automation Scripts metadata in ASS subtitle projects without verifying user trust in the scripts or their authors. This allows an...
CVE-2026-92705: Improper Neutralization of Null Byte or NUL Character
Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...
CVE-2026-108264: Improper Neutralization of Special Elements Used in a Template Engine
Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...
CVE-2026-78797: Improper Control of Generation of Code
An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the taskid in tasks-lib.lua...
CVE-2026-7827: Stack-based Buffer Overflow
A stack-based buffer overflow in the RdbLoadEntity function of the RDB graph decoders src/serializers/decoders//decodegraphentities.c in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands for example, against an instance with no password configured to cause a...
PT-2026-108906
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, an...
PT-2026-108871
Name of the Vulnerable Software and Affected Versions Livees Checkout WordPress plugin versions prior to 7.0.3 Description The order confirmation page fails to perform capability, nonce, or order-key checks before processing request parameters. This allows unauthenticated users to modify the stat...
CVE-2026-107806: Improper Control of Generation of Code
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...
PT-2026-108723
Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.18.1 Description A double free and use-after-free issue exists in the RdbLoadDeletedNodes function of the RDB graph decoders. A remote attacker capable of issuing Redis replication commands can trigger a denial of...
