27568 matches found
SUSE CVE-2026-43734
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpecte...
[SECURITY] Fedora 44 Update: ansible-collection-ansible-posix-2.2.1-1.fc44
Ansible Collection targeting POSIX and POSIX-ish platforms...
CVE-2026-42168
The django-pyas2 file transfer server (versions through 1.2.3 ) is vulnerable to OS command injection because the cmd_receive and cmd_send fields on the Partner model are passed directly to the os.system() function in pyas2/utils.py without proper sanitization. This flaw allows an authenticated a...
The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Windows operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the Microsoft Message Queuing MSMQ service on Windows operating systems relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the USB driver for Windows operating systems allows attackers to gain increased privileges.
The vulnerability of the USB driver for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
The vulnerability of the Network File System (NFS) on Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the Network File System NFS on Windows operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of client machines in Windows operating systems when using the Remote Desktop Client allows attackers to escalate their privileges.
The vulnerability of the Remote Desktop Client for Windows operating systems in dealing with client remote desktops is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges remotely...
The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
The vulnerability of the NTFS file system in Windows operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the NTFS file system in Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Windows operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the Microsoft Message Queuing MSMQ service on Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...
The vulnerability of the Win32k.sys component in Windows operating systems, which allows a hacker to increase their privileges
The vulnerability of the Win32k.sys component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...
CVE-2026-55173 AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command execution at the same execAsync sh -c sink
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
EUVD-2026-45040
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
CVE-2026-55173
WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & the shell background operator. CVE-2026-33482 reported that sanitizeFFmpegCommand...
MAL-2026-10744 Malicious code in patchwork-os (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...
Malicious code in dde-common (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...
July 14, 2026—KB5101649 (OS Build 28000.2525)
None None...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...