53236 matches found
CVE-2026-55578
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...
CVE-2026-55578 Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shellexec. After the fix for GHSA-9643-6xjp-vx57 which...
CVE-2026-54540 Authenticated terminal command whitelist bypass in Pheditor
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...
CVE-2026-54540
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...
CVE-2026-54540
Summary: Pheditor prior to 2.0.5 exposes an authenticated terminal command whitelist bypass. The vulnerability occurs in the terminal feature, which checks if the submitted command starts with a configured value and then passes the full string to shell_exec(). Because shell commands can be execut...
CVE-2026-54540 Authenticated terminal command whitelist bypass in Pheditor
Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature checks whether the submitted command starts with one of the configured TERMINALCOMMANDS values, then passes the full command...
K000162461: PostgreSQL vulnerability CVE-2026-6475
Security Advisory Description Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these...
CVE-2026-59920
A flaw was found in the Netty STOMP Streaming Text Oriented Messaging Protocol decoder. This vulnerability allows a remote attacker to inject arbitrary protocol frames by crafting malformed STOMP commands that contain embedded carriage return CR and line feed LF sequences. This bypasses message...
CVE-2025-59172
The CVE concerns Ericsson Packet Core Controller (PCC) with versions older than 1.38, where an Improper Neutralization of Special Elements in an OS command allows an attacker to execute arbitrary code as root. Impact is high (per CVSS metrics: AV Adjacent, AC Low, PR High, UI None, with high impa...
CVE-2026-59688
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...
CVE-2026-12989
A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...
EUVD-2026-49185
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...
EUVD-2026-49184
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...
CVE-2026-12989
CVE-2026-12989 describes a lack of authentication in Ghost Robotics' Vision 60 mobile app (APK v5.5.0). An unauthenticated attacker on the device’s internal Wi‑Fi can access the web administration interface and HTTP API, bypassing authorization to view real‑time camera feeds, control robot moveme...
CVE-2026-12989 Multiple vulnerabilities in Ghost Robotics' Vision 60
A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...
EUVD-2026-49179
A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...
PT-2026-64895
A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...
Exploit for Improper Authorization in Microsoft
Certighost Slidev deck This directory contains the Slidev pre...
CVE-2026-17497
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
Linux Distros Unpatched Vulnerability : CVE-2025-71408
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK Natural Language Toolkit before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls...