CVE-2026-67243

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...

CVE-2026-67243

The CVE concerns freo2 (provided by refirio). It describes an unrestricted upload of a dangerous file type, where a user with the product’s highest‑level admin privileges may upload an executable and execute arbitrary OS commands. CVSS details indicate a network attack vector, high impact on conf...

EUVD-2026-52535

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

EUVD-2026-52524

Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

CVE-2026-66312

Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

PT-2026-67569

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Missing authorization in the software allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newe...

CVE-2026-14538

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...

CVE-2026-14538: Improper Authorization

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...

CVE-2026-66803

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

EUVD-2026-51302

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

SUSE CVE-2026-35607

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 "self-registered users don't get execute perms" stripped Execute permission and Commands from users created via the...

CVE-2026-47876

CVE-2026-47876 is an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter of VMware ESX/ESXi. A local administrator inside a VM using VMXNET3 can potentially execute code on the ESX host; non-VMXNET3 adapters are not affected. Connected documents confirm patches/updates have b...

PT-2026-66599

Name of the Vulnerable Software and Affected Versions Azure Cosmos DB affected versions not specified Description Improper access control allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a fi...

PT-2026-66454

Name of the Vulnerable Software and Affected Versions Eaton Tripp Lite Series PADM firmware affected versions not specified Description Improper input validation in a session management interface allows an authenticated administrator to execute arbitrary commands within a restricted environment...

CVE-2026-8339

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 inclusive. A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands...

CVE-2026-63227

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...

PT-2026-65703

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize, write a webshell to a publicly accessible location, and execute arbitrary code on the server...

CVE-2026-14958 OS command injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-50736

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...

CVE-2026-51304

A flaw was found in sqlite. A remote attacker can exploit a use-after-free vulnerability in the ORDER BY clause parsing routine by crafting a malicious SQL statement. This can lead to an application crash, sensitive information disclosure, and in some cases, arbitrary code execution, allowing the...