Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

EUVD-2026-48919

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

EUVD-2026-48915

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-16733

The CVE refers to bahmutov find-cypress-specs (up to version 1.54.12) where the function shell.exec in src/index.js of the Branch Handler is vulnerable. Manipulating the --branch argument leads to OS command injection. The attack is described as locally executable, with the exploit publicly avail...

Cisco IOS 12.4 HTTP Server Cross-Site Request Forgery (CVE-2008-4128)

According to its self-reported version, Cisco IOS 12.4 is affected by multiple cross-site request forgery CSRF vulnerabilities in the HTTP administration component. An unauthenticated, remote attacker can exploit these by persuading an authenticated user to follow a malicious link, allowing...

CVE-2026-16628

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

CVE-2026-16628 oclif JIT Plugin Entry child_process.exec os command injection

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

CVE-2026-16628 oclif JIT Plugin Entry child_process.exec os command injection

A vulnerability was detected in oclif up to 4.23.16. Affected by this vulnerability is the function childprocess.exec of the component JIT Plugin Entry Handler. Performing a manipulation of the argument jitPlugins results in os command injection. The attack is only possible with local access. The...

mongo-express Remote Code Execution

mongo-express before 0.54.0 is vulnerable to remote code execution via endpoints that uses the toBSON method and misuse the vm dependency to perform exec commands in a non-safe environment. id: CVE-2019-10758 info: name: mongo-express Remote Code Execution author: princechaddha severity: critical...

CVE-2026-64021

A flaw was found in the Linux kernel's drm/xe/oa component. A resource leak occurs in the xeoastreamopenioctl function when an execqueue reference is not properly released. This can cause the execqueue and associated file private state to remain allocated indefinitely, potentially leading to a...

PT-2026-63512

Name of the Vulnerable Software and Affected Versions syncfusion ej2-javascript-ui-controls versions prior to 33.2.4 Description An OS command injection flaw exists when the software is accessed locally. The issue resides in the child process.exec function within the package.json file, where...

PT-2026-63510

Name of the Vulnerable Software and Affected Versions oclif versions prior to 4.23.17 Description An OS command injection issue exists in the JIT Plugin Entry Handler component. A local attacker can manipulate the jitPlugins argument to execute arbitrary commands via the child process.exec...

CVE-2026-16489

CVE-2026-16489 affects jsforce up to 3.10.16 in the SFDX Connection Registry. The vulnerability targets the function _execCommand within lib/registry/sfdx.js, enabling OS command injection from a local environment. An exploit is publicly available; the issue was reported early but no remediation ...

kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

A flaw was found in the Linux kernel. Specifically, within the drm/xe graphics driver, two error handling issues in the xeexecqueuecreateioctl function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially...

CVE-2026-63952

A flaw was found in the Linux kernel's memfd component. When the SEALEXEC flag is used to create a memory file descriptor, the SEALWRITE flag is implicitly applied to prevent writing to executable memory. However, this implicit write protection is applied after checks that should deny writable...

SUSE CVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

Linux Distros Unpatched Vulnerability : CVE-2026-64021

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix execqueue leak on width check in stream open In xeoastreamopenioctl, when...