37286 matches found
EUVD-2026-59848
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been...
CVE-2026-19932 DefaultFuction Notice-System-Managent NoticeController execute GroovyShell.evaluate code injection
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been...
PT-2026-73078
A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been...
PT-2026-73173
A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the...
Exploit for CVE-2026-47117
CVE-2026-47117: OpenMed Unauthenticated Remote Code Execution...
Malicious code in tw-pkgprobe-7731 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...
CVE-2026-18503 vulnerabilities
Vulnerabilities for packages: python...
SUSE CVE-2026-18408
Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-871...
GHSA-2M8M-JHRM-W6J2 vulnerabilities
Vulnerabilities for packages: telegraf...
CVE-2026-73505
A flaw was found in Oh My Posh. A local attacker could craft a malicious directory name containing a Go template expression. When the prompt renders within this directory or its subdirectories, the embedded template expression could execute arbitrary operating system commands as the current user...
MINI-6HP2-RWJ3-QXJ5
Bulletin has no description...
CVE-2026-19768
Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...
Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint
Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...
EUVD-2026-58661
Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...
CVE-2026-19768
CVE-2026-19768 affects Devolutions PowerShell Universal (settings feature) prior to and including 2026.2.3. An authenticated user with settings management permission can cause code injection by writing a crafted setting value that is not properly escaped when written to the settings configuration...
CVE-2026-19768
Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...
CVE-2026-19768
Improper control of generation of code 'Code Injection' in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped...
GO-2026-4352 vulnerabilities
Vulnerabilities for packages: opentofu...
GO-2026-4980 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-route53recoverycontrolconfig-fips, helmfile, apm-server-fips, nifikop-fips, k8sgateway-fips, cloud-provider-azure-fips, nginx-kubernetes-ingress, crossplane-function-go-templating-fips, kubevela, temporal-server, aws-flb-kinesis, juicefs,...