1121487 matches found
jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...
CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...
CVE-2026-53790
CVE-2026-53790 affects rsync up to and including version 3.4.x (prior to 3.5.0). The vulnerability involves multiple command and argument injection paths, including RSYNC_CONNECT_PROG, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection. Attackers can inject shell metacharacte...
CVE-2026-53790
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...
CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...
CVE-2026-53790 rsync < 3.5.0 Command Injection via Multiple Code Paths
rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNCCONNECTPROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shel...
CVE-2026-67986
amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...
CVE-2026-61962
Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...
CVE-2026-67986
amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...
CVE-2026-27544
Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...
CVE-2026-27380
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...
CVE-2026-66256
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...
EUVD-2026-57918
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...
CVE-2026-61962
Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...
CVE-2026-61962
WP BASE Booking (WordPress plugin) versions
CVE-2026-61962 WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability
Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...
EUVD-2026-57969
Unauthenticated Arbitrary Code Execution in WP BASE Booking = 6.3.0 versions...