CVE-2026-27565

This remote code execution vulnerability allows an unauthenticated remote attacker to upload a malicious IODD file that places and executes a shell script with root privileges on the target system. The shell script persists across reboots , enabling sustained compromise. The CVSS 3.1 score is 9.8...

MAL-2026-16207 Malicious code in chai-as-agile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263 On require'chai-as-agile', index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to...

MAL-2026-16204 Malicious code in @prime0/alanced-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3 The package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a...

CVE-2026-76552 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remot...

CVE-2026-76550 WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

CVE-2026-76551 WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

EUVD-2026-81014

An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOTia32.efi and a crafted cloak32.dat file on the ESP...

PT-2026-93768

Name of the Vulnerable Software and Affected Versions Jenkins Script Security Plugin versions prior to 1415.v9a f9b 3a c253d Description The plugin fails to reject the @GroovyASTTransformationClass annotation. This allows users with permissions to define and execute sandboxed scripts, such as...

ROS-20260916-73-0047

The vulnerability in the kernel-lt is related to errors in processing input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Linux Distros Unpatched Vulnerability : CVE-2026-45051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, WebAuthnAuthentication loads a serialized AuthenticatorImpl object graph from t...

Oracle Coherence CVE-2026-83411 (September 2026 CSPU)

The 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of Coherence installed on the remote host are affected by a vulnerability as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are...

Jenkins plugins Multiple Vulnerabilities (2026-09-16)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes,...

Sandbox bypass vulnerability in script-security

script-security provides a sandbox feature that allows running user-provided scripts safely by intercepting and checking potentially unsafe operations. script-security 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, which a script can use to link an...

Path traversal vulnerability in robot

robot 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller. This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file...

CVE-2026-92592: Improper Neutralization of Special Elements Used in a Template Engine

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

PT-2026-93358

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

CVE-2026-27556: Improper Control of Filename for Include/Require Statement in PHP Program

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...

CVE-2026-27555: Improper Control of Filename for Include/Require Statement in PHP Program

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/getioddportinfo endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device...

(0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The specific flaw exists within the...