18023 matches found
EUVD-2026-90208
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...
CVE-2026-55094 Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the GraphQL endpoint and parses filter...
CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
CVE-2026-103474
The yii2-starter-kit software, through version 4.2.0 , contains an Unrestricted File Upload vulnerability in the backend storage upload actions. The root cause is a failure to validate file types, which allows authenticated users with the manager role to upload PHP files . An attacker can leverag...
CVE-2026-103474 yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the serv...
CVE-2026-55107 Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...
CVE-2026-55107 Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts LLM-generated code, user formulas, student submissions, third-party plugins in-process without giving them access to host memory, files, network, or credentials. Fr...
CVE-2026-55107
The Kobako Ruby gem (versions 0.1.0 through 0.9.0 ) contains a critical sandbox escape vulnerability. The root cause is an unguarded Object#public_send sink in the transport dispatcher, which allows guest mruby scripts to execute arbitrary Ruby in the host process. Attackers can pivot through the...
CVE-2026-47587
A flaw was found in nvidia-driver. A local unprivileged user can trigger a use-after-free condition in the NVIDIA GPU Display Driver for Linux, allowing them to execute arbitrary code or escalate privileges on the system. Successful exploitation could also result in a Denial of Service DoS,...
Exploit-Machine
Analisis Kerentanan — Canto HackMyVM Breakdown alur exploit...
CVE-2026-102427
The OrdaSoft Joomla CCK extension (versions
Exploit for CVE-2026-94545
CVE-2026-94545: Next.js next/og Unauthenticated Remote Code...
SUSE CVE-2026-102306
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-94389
Unauthenticated Remote Code Execution RCE in AcyMailing SMTP Newsletter = 11.0.5 versions...
CVE-2026-96349 WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution RCE in SiteSkite = 2.1.8 versions...
EUVD-2026-89862
Unauthenticated Remote Code Execution RCE in SiteSkite = 2.1.8 versions...
CVE-2026-96349
The WordPress SiteSkite plugin versions