MGASA-2026-0167 Updated vim packages fix security vulnerabilities

Heap Buffer Overflow in spell file loading affects Vim 9.2.0450. CVE-2026-45130 Vimscript Code Injection in netrw NetrwMarkFile via crafted filename affects Vim 9.2.0480. CVE-2026-43961 Command Injection in tar.vim affects Vim 9.2.0479. CVE-2026-46483 Vimscript Code Injection in netrw...

Student-Management-System Code Injection Vulnerability

Student-Management-System is an open-source student information management system developed by Cyber-III. Version 1.0 of STUDENT-MANAGEMENT-SYSTEM contains a code injection vulnerability. This vulnerability stems from the Name parameter on the dashboard page, which contains cross-site scripting,...

CicadasCMS code injection vulnerability

CicadasCMS is a content management framework developed by the Chinese individual developer westboy, based on SpringBoot, Mybatis, SpringSecurity, and Vue. CicadasCMS has a code injection vulnerability. This vulnerability stems from the Search method in the...

Debian dsa-6311 : php-twig - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6311 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6311-1 [email protected] https://www.debian.org/securit...

Arbitrary Code Injection

Overview redshift-connector is a Redshift interface library Affected versions of this package are vulnerable to Arbitrary Code Injection due to the use of eval on untrusted data received from the server, in the vectorin function. An attacker can execute arbitrary code on the client system by...

[SECURITY] [DSA 6311-1] php-twig security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6311-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 29, 2026 https://www.debian.org/security/faq -...

WS-2022-0407

code injection in "Wrapper::buildClientWrapperCode" via manipulation of the "$client" argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url...

Acer Predator Connect W6x code injection vulnerability

The Acer Predator Connect W6x is a series of high-performance Wi-Fi 6/6E gaming routers produced by Acer of Taiwan, China. The Acer Predator Connect W6x has a code injection vulnerability, which stems from allowing injections and execution of arbitrary shell commands...

Arbitrary Code Injection

Overview electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client Affected versions of this package are vulnerable to Arbitrary Code Injection via the import process of bookmark data or during sync operations. An attacker can execute arbitrary code by injecting malicious fields into...

[SECURITY] [DLA 4604-1] roundcube security update

Debian LTS Advisory DLA-4604-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin May 28, 2026 https://wiki.debian.org/LTS Package : roundcube Version : 1.4.15+dfsg.1-1+deb11u9 CVE ID : CVE-2026-48842 CVE-2026-48843 CVE-2026-48844 CVE-2026-48845 CVE-2026-48846...

Mapfish-Print code injection vulnerability

Mapfish-Print is a JAVA extension library created by individual developers for creating maps-related reports. This extension library is based on Java’s servlet/lib/application framework and can implement a service that receives requests and returns reports. Versions of Mapfish-Print from 3.23.0 t...

GitButler code injection vulnerability

GitButler is an open-source modern Git version control interface that supports AI workflows. Versions of GitButler prior to 0.19.7 contained a code injection vulnerability. This vulnerability could allow arbitrary scripts to execute in the Tauri webview due to the malicious links present in the...

CodeWhale code injection vulnerabilities

CodeWhale is a terminal coding tool developed by Hunter Bown as an individual developer. Versions of CodeWhale prior to 0.8.26 contained a code injection vulnerability. This vulnerability stemmed from the taskcreate tool, which generated persistent sub-proxies that inherited two insecure default...

Debian dla-4604 : roundcube - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4604 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4604-1 [email protected]...

PT-2026-83255

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.19 Pimcore versions prior to 12.3.10 Pimcore versions prior to 2026.1.6 Description An authenticated user with objects permission can achieve remote code execution RCE and perform SQL injection via the...

Debian dsa-6301 : roundcube - security update

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6301 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6301-1 [email protected]...

[SECURITY] [DSA 6301-1] roundcube security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6301-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 27, 2026 https://www.debian.org/security/faq -...

CVE-2026-9568

A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack'...

Arbitrary Code Injection

Overview langroid is a Harness LLMs with Multi-Agent Programming Affected versions of this package are vulnerable to Arbitrary Code Injection via the runquery function. An attacker can execute arbitrary system commands on the database server by crafting malicious input that is processed by the LL...

CVE-2026-44888

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile endpoint writes user-supplied numeric config values e.g., SMTPPORT directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec every 3–5 minutes...