CVE-2026-64815

JetBrains IntelliJ IDEA is affected by CVE-2026-64815 for versions prior to 2026.2. The vulnerability allows arbitrary code injection via UI Designer form files. Root cause details are not provided in the supplied documents, but the weakness enables code execution under certain conditions, as ind...

CVE-2026-15011

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15011

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

EUVD-2026-47918

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15011

CVE-2026-15011 concerns the WordPress plugin “Customer Support Ticket System & Helpdesk” (up to version 6.0.5). The vulnerability stems from dynamic function invocation on an attacker-controlled value via the public-facing path parameter, with insufficient validation. This allows unauthenticated ...

CLSA-2026-1782138605 vim: Fix of 2 CVEs

CVE-2026-47162: fix code injection via NetrwBookHistSave by quoting the directory name with string...

RLSA-2026:41899 Important: .NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18...

CVE-2026-60122: Improper Control of Generation of Code

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...

CVE-2026-64815: Improper Control of Generation of Code

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files...

CVE-2026-15011: Improper Control of Generation of Code

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

PT-2026-63969

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description Arbitrary code injection is possible through the use of UI Designer form files. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

PT-2026-63591

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-60122: Improper Control of Generation of Code

gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data to execute arbitrary OS commands by injecting malicious content into the SKY.satellites.used field, which is inserted unsanitize...

CVE-2026-47668: Improper Input Validation

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner POST /runners/start allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically...

RockyLinux 9 : .NET 10.0 (RLSA-2026:41898)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41898 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

RockyLinux 10 : .NET 10.0 (RLSA-2026:41897)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41897 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

Arbitrary Code Injection

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Arbitrary Code Injection via crafted expressions using arrow functions in the expression. An attacker can execute arbitrary system commands by bypassing the intended sandbox restrictions. Note...

CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...