The vulnerability of the control consoles for SonicWall SMA 1000 microprogrammed network interface devices allows attackers to execute arbitrary code.

The vulnerability of the control consoles for SonicWall’s SMA 1000 microprogrammed network interface devices is related to improper code generation. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2025-65720

Open Source GPT Researcher v3.3.7 is affected by CVE-2025-65720, described as a remote code execution vulnerability. Attackers can cause arbitrary commands to run on a victim system by interacting with a crafted HTML page. The linked ENISA EUVD entry confirms the issue and references exploitation...

CVE-2026-30623

CVE-2026-30623 affects LiteLLM 1.18.10 via the MCP server creation feature. The vulnerability arises when MCP configuration JSON can set arbitrary values for command and args, which LiteLLM executes on the host without validation, enabling remote code execution with the LiteLLM process privileges...

PT-2026-60183

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller affected versions not specified Description An injection flaw exists in the configuration generator when the software is configured with Custom Resource Definitions CRDs or Ingress annotations. Multiple user-controllab...

PT-2026-60377

Name of the Vulnerable Software and Affected Versions TensorZero versions prior to 2026.6.0 Description The /internal/object storage endpoint accepts a caller-supplied JSON storage path parameter that dynamically overrides the object storage configuration. By abusing the filesystem storage type, ...

PT-2026-60311

Name of the Vulnerable Software and Affected Versions xszyou Fay version 4.3.1 Description Remote code execution is possible via the MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface to configure an MCP STDIO...

PT-2026-58872

Name of the Vulnerable Software and Affected Versions ASUS router models affected versions not specified Description Improper Validation of Integrity Check Value and Improper Certificate Validation allow a remote man-in-the-middle MITM user to force the router to download and execute arbitrary...

CVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling...

CVE-2025-65720

An issue in Open Source GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page...

PT-2026-60233

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Cloud Platform versions prior to 10.5.2605.0 Splunk Cloud Platfo...

PT-2026-60309

Name of the Vulnerable Software and Affected Versions GPT Researcher version 3.3.7 Description An issue allows attackers to execute arbitrary commands on a victim system through command injection. This occurs when a user interacts with a specially crafted HTML page, and no authentication is...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : alsa-lib vulnerability (USN-8538-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8538-1 advisory. It was discovered that alsa-lib incorrectly handled certain ALSA configuration text. An attacker could use this issue to cause alsa-lib to...

The vulnerability of the Python programming language’s pip module, related to the inclusion of functions from an unreliable and uncontrolled area, allows a perpetrator to execute arbitrary code.

The vulnerability of the Python programming language’s pip module is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code...

Vulnerability of .NET and Microsoft Visual Studio software platforms, related to deserialization mechanism flaws, allows attackers to execute arbitrary code.

The vulnerability of .NET and Microsoft Visual Studio software platforms is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-51807

Heap-based out-of-bounds write in j2kprecinctsubband::parsepacketheader in OpenHTJ2K versions 0.18.3 and earlier fixed in v0.18.4 caused by missing bounds validation before coding-pass lengths are written to j2kcodeblock::passlength128. A crafted JPEG 2000 codestream containing malformed PPM pack...

Arbitrary File Upload

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Arbitrary File Upload via the file upload process. An attacker can execute arbitrary code in the context of the current user by uploading a file with a dangerous type and...

kernel: XFS data corruption using reflink

A flaw was found in the XFS filesystem. A race condition in the copy-on-write mechanism for reflinked files can cause writes to bypass the copy-on-write process and modify shared data blocks directly. As a result, data intended for a private copy may be written to the original shared location,...

CVE-2026-48353

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

CVE-2026-48336

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48334

Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that...