CVE-2026-48371

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

EUVD-2026-44109

Stack-based buffer overflow in Windows Resilient File System ReFS allows an unauthorized attacker to execute code locally...

EUVD-2026-44071

Heap-based buffer overflow in Windows Resilient File System ReFS allows an unauthorized attacker to execute code locally...

EUVD-2026-43994

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network...

EUVD-2026-43981

Use after free in DNS Server allows an authorized attacker to execute code over a network...

CVE-2026-50426

Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network...

EUVD-2026-44221

Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally...

EUVD-2026-44198

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-44183

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-50299

Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack...

CVE-2026-54999

The CVE-2026-54999 entry concerns a race condition in Windows TCP/IP where concurrent access to a shared resource allows an unauthorized attacker on an adjacent network to execute code. Documented impact is remote code execution with high severity (CVSSv3.1: AV=A, AC=L, PR=N, UI=N, S=U, C=H, I=H,...

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Numeric truncation error in Windows Resilient File System ReFS allows an authorized attacker to execute code locally...

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the ExecTool.Execute function in the exec tool component. An attacker can execute arbitrary operating system commands by providing crafted input to this function. Remediation There is no fixed version for...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebTool.Execute function in the web.go file when processing the url argument. An attacker can make unauthorized requests to internal or external systems by supplying crafted URLs. Remediation The...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the WebTool.Execute function in the web.go file when processing the url argument. An attacker can make unauthorized requests to internal or external systems by supplying crafted URLs. Remediation The...

CVE-2026-15668

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

CVE-2026-15669

Technical details (affected products, vulnerable components, exploit vectors) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15669 louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection

A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public...