Magento-eCommerce-RCE-CVE-2015-1397

Magento Shoplift Exploit SUPEE-5344 - CVE-2015-1397 Overview This script exploits the CVE-2015-1397 vulnerability in Magento, commonly referred to as the Magento Shoplift exploit. It allows an attacker to create a new admin user in the Magento database by injecting SQL payloads. Originally writte...

Security update for python-Pillow

This update for python-Pillow fixes the following issues: CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek in MPO and DCX bsc1286802. CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek leads to unbounded allocation DoS bsc1286801. CVE-2026-96640: PD...

SUSE-SU-2026:5038-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues: - CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek in MPO and DCX bsc1286802. - CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek leads to unbounded allocation DoS bsc1286801. -...

CVE-2026-98171

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious or compromised remote server can exploit this flaw by sending specially crafted compound encrypted network responses. Due to improper bounds validation and pointer lifecycle management, the client can encounter a...

Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-105483: TLS certificate...

SUSE-SU-2026:5037-1 Security update for nodejs24

This update for nodejs24 fixes the following issues: Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-105483: TLS...

Security update for nodejs22

This update for nodejs22 fixes the following issues: CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. CVE-2026-106069: TLS certificate hostname bypass when th...

SUSE-SU-2026:5036-1 Security update for nodejs22

This update for nodejs22 fixes the following issues: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve truncates names containing NUL char bsc1286561. - CVE-2026-106069: TLS certificate hostname bypass...

CVE-2026-77880

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77876

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the protecteddirectory user panel module that allows attackers to execute arbitrary commands by submitting unescaped input through the file POST parameter in the acc=deletedp action. Attackers can...

CVE-2026-16306

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

Security Bulletin: IBM Documentation Offline is vulnerable to multiple vulnerabilities via Node.js (CVE-2026-111497, CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106074)

Summary IBM Documentation Offline uses Electron, Node.js and Google Brotli as part of its runtime environment and asset decompression. A buffer overflow in Google Brotli CVE-2026-111497 could allow a remote attacker to cause memory corruption, denial of service, or execute arbitrary code via a...

Exploit for Improper Encoding or Escaping of Output in Synology Beestation_Os

Synology DSM Vulnerability Detection Scanner This is a scanne...

HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites

On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell , Node2Shell , and Brotli2Shell. Despite the first name, the...

CVE-2026-16306 CVE-2026-16306

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

EUVD-2026-115254

Remote Code Execution in the IModular.exe URI handler in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command...

CVE-2026-16306

A Remote Code Execution vulnerability exists in the IModular.exe URI handler within INFINITT Healthcare Co., Ltd. INFINITT PACS . A remote unauthenticated attacker can exploit this by providing a crafted imodular:// URI that includes attacker-controlled command and argument parameters. This flaw ...

EUVD-2026-115247

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77880

Control Web Panel (CWP) versions before 1.16 are vulnerable to an OS command injection in the loopback API password change route /newpass/. The flaw exists because the POST user parameter is passed unescaped into a shell command that runs with root privileges . An attacker can exploit this to inj...

CVE-2026-77880 Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...