264381 matches found
KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails
Overview On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classifi...
JLSEC-2026-906
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor Component uses transformers-4.57.6-py3-none-any.whl, transformers-5.3.0-py3-none-any.whl, netty-codec-http-4.2.12.Final.jar, netty-codec-dns-4.2.12.Final.jar, netty-resolver-dns-4.2.12.Final.jar which are vulnerable to CVE-2026-5241, CVE-2026-42580,...
CVE-2026-47078
A flaw was found in the Erlang OTP stdlib zip module. The zip:unzip and zip:extract functions, which handle archive extraction, are vulnerable to a relative path traversal attack. A remote attacker could craft a malicious zip archive containing specially formed entry names. When processed, this...
Azure Cosmos DB Remote Code Execution Vulnerability
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...
CVE-2026-66039
A flaw was found in FFmpeg. A remote attacker could exploit a signed integer overflow vulnerability in the MACE6 audio decoder by providing a specially crafted CAF Core Audio Format file. This malicious file manipulates the bytesperpacket value, leading to an undersized memory allocation and a he...
CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-54368
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
CVE-2026-54363
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-54368
CVE-2026-54368 (CentreStack) : CentreStack versions before 17.4 are vulnerable to an SQL injection in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header to the jsondir API endpoint, causing unsanitized interpolation of the Field paramet...
CVE-2026-54368 CentreStack < 17.4 SQL Injection via x-glad-filter Header
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
EUVD-2026-51104
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
CVE-2026-54368
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
EUVD-2026-51099
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-54363
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-54363
CentreStack
CVE-2026-54363 CentreStack < 17.5 Hardcoded Key Token Forgery RCE
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-59310 vCenter directory-traversal vulnerability
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...