517852 matches found
CVE-2025-67066
A SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote, unauthenticated attacker to execute arbitrary code by manipulating the outtype parameter in the /outaddresspaging path. The CNA-assigned CVSS v3.1 score is 9.8 (Critical) , reflecting network reachability with low complexit...
PT-2026-85574
Name of the Vulnerable Software and Affected Versions TEN Framework version 0.11.71 Description The TMAN Designer component contains flaws allowing unauthenticated users to read and write arbitrary files. By sending POST and PUT requests to the '/api/designer/v1/file-content' endpoint, an attacke...
UBUNTU-CVE-2026-76174
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows ...
CVE-2026-71624
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...
CVE-2026-85046
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106462)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106462 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...
MiracleLinux 9 : wget-1.21.1-11.el9_8 (AXSA:2026-1757:02)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1757:02 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution...
CVE-2026-75430
PowerJob Worker version 5.1.2 (and likely earlier) exposes the /worker/deployContainer HTTP endpoint without authentication on its default transport port, allowing a remote unauthenticated attacker to execute arbitrary code . The vulnerability is scored CVSS 9.8 (Critical) — network attack vector...
CVE-2026-31020
CVE-2026-31020 affects DocsGPT 0.15.0 and below , where the application's custom prompt feature renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. This enables an unauthenticated attacker to inject malicious template expressions, resulting in a serve...
Google Chromium V8 Type Confusion Vulnerability
Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge,...
CVE-2026-75431
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ffmpeg (UTSA-2026-106195)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106195 advisory. FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by...
EUVD-2026-71448
PowerJob Server version 5.1.2 and likely earlier uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code...
EUVD-2026-71772
easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...
UBUNTU-CVE-2026-71220
A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2edit, the diheight field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem image...
PT-2026-86244
An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components...
PT-2026-85783
Cross Site Scripting vulnerability in Netgate pfSense Plus software versions = 26.03 pfSense CE software versions = 2.8.1 allows a remote attacker to execute arbitrary code via the captive portal status.widget.php file...
PT-2026-85691
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...