Exploit for Code Injection in Vmware Spring_Cloud_Function

No d...

CVE-2026-59291

CVE-2026-59291...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

EUVD-2026-64242

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

CVE-2026-78003 Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery SSRF via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the addlist function, which accepts user-controlled array keys from $POST'addresses', passes...

Linux Distros Unpatched Vulnerability : CVE-2026-68767

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length...

PT-2026-79567

hashcat's fgetl function in src/filehandling.c writes a null terminator one byte past the caller's buffer when an input line is exactly the buffer length. Attackers can trigger this out-of-bounds heap write by providing a hash file, potfile, or wordlist containing a line of exactly HCBUFSIZ LARGE...

PT-2026-79746

Name of the Vulnerable Software and Affected Versions WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels versions prior to 4.9.9 Description An issue exists in the get image src in base64 function that allows authenticated users with subscriber-level access or...

VulnCheck KEV: CVE-2021-27691

Command Injection in Tenda G0 routers with firmware versions v15.11.0.69039CN and v15.11.0.55876CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This...

CVE-2026-77413

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-68508

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...

GHSA-66MM-25PP-RFFF JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to: - overwriting $clone allowing mutation of objects via transforms see evaluateTransformExpression - it being possible to destruct jsonata functions/lambdas e.g. $merge. - applyProcedure using...

JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

Before JSONata 2.2.1 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to: - overwriting $clone allowing mutation of objects via transforms see evaluateTransformExpression - it being possible to destruct jsonata functions/lambdas e.g. $merge. - applyProcedure using...

CVE-2026-68508

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...

Arbitrary Code Injection

Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Arbitrary Code Injection via the lookup function due to a missing hasOwnProperty check. An attacker can execute arbitrary code by submitting crafted expressions. Remediation Upgrade...

GHSA-8GQ3-VP5J-2GRP JSONata: Arbitrary Code Execution via crafted JSONata expressions

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...

JSONata: Arbitrary Code Execution via crafted JSONata expressions

Impact Before JSONata 2.2.0 and 1.8.8 it was possible to execute arbitrary code with crafted expressions, due to a missing hasOwnProperty check in the lookup function: https://github.com/jsonata-js/jsonata/blob/f9632e01e6e67d4f9f00593f9795420cb4b57f48/src/functions.jsL1686-L1705 This was fixed wi...

EUVD-2026-64155

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...