GNU Emacs: Arbitrary code execution

Background GNU Emacs is the extensible, customizable, self-documenting real-time display editor. Description A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details. Impact An attacker could achieve arbitrary code execution by tricking a use...

CVE-2026-77945

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public...

EUVD-2026-64245

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public...

CVE-2026-77945 TRENDnet TEW-821DAP ssi upload.cgi command injection

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component ssi. Performing a manipulation of the argument filename results in command injection. The attack may be initiated remotely. The exploit has been made public...

CVE-2026-77945

A command injection vulnerability exists in TRENDnet TEW-821DAP firmware version 2.2.01b05 , specifically in the ssi component within the file /cgi-bin/upload.cgi. An attacker can manipulate the filename argument to inject arbitrary commands. The attack is remotely exploitable and requires low pr...

CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

EUVD-2026-63829

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-74866

@fastify/busboy (a multipart form-data parser for Node.js) is vulnerable to CRLF injection via the Content-Disposition filename and field name. The part-header parser splits lines only on the two-byte CRLF sequence, so a lone carriage return or line feed embedded in a part header is carried verba...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

SUSE CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

Arbitrary File Upload

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only...

CVE-2026-73254 Mongoose: Stored XSS via unescaped filenames in directory listing

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2025-14602

vsDesk generates uploaded file names using a predictable timestamp-based method, allowing remote attackers to guess filenames and access uploaded files. Patched in version 14.0101; CVSS 4.0 scores it MEDIUM (5.3). No in-the-wild exploitation reported. Patch available from https://vsdesk.ru/. Advi...

EUVD-2025-210743

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

UBUNTU-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a f...

Linux Distros Unpatched Vulnerability : CVE-2026-65612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted...

CVE-2025-36398

CVE-2025-36398 affects IBM System Storage DS8A00 (10.1.3.0–10.11.35.0) and IBM DS8900F (89.40.83.0–89.44.25.0). An authenticated user can read or modify another user's command history due to an externally controlled filename , resulting in low confidentiality and integrity impact (CVSS 3.1: 5.4 M...

CVE-2025-36398 DS8900F and DS8A00 Information Disclosure

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...