264542 matches found
EUVD-2026-49352
sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by illegal memory access, which may lead to arbitrary code execution, sensitive information leakage and service denial...
ROS-20260727-73-0013
A vulnerability in apache-activemq related to a failure to implement measures to protect the structure of a web page. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...
PT-2026-64999
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description A remote code execution issue exists in the configuration API. Authenticated administrators possessing CONFIGURATION EDIT and ATTACHMENT ADD privileges can write arbitrary PHP files by manipulating...
sharepoint-2026-poc
SharePoint /trust WS-Federation Deserialization — PoC & Det...
CVE-2026-17497
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
CVE-2026-17497 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
CVE-2026-17497
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
EUVD-2026-49056
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
CVE-2026-17497
NoteGen before 0.32.0 allows arbitrary OS command execution via the Tauri shell plugin shell:allow-execute for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript in the app’s webview can invoke plugin:shell|execute to run attacker-controlled command...
CVE-2026-17497 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python
NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...
gitpython: GitPython: Remote Code Execution via Newline Injection in config_writer()
A flaw was found in GitPython. This vulnerability allows attackers to inject newline characters into the section parameter of the configwriter function, leading to the injection of arbitrary section headers into the .git/config file. By forging a core section with a malicious hooksPath, an attack...
CVE-2026-63720
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
CVE-2026-63720
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
EUVD-2026-49050
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
CVE-2026-63720 datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field
datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...
CVE-2026-63720
CVE-2026-63720 affects datamodel-code-generator prior to version 0.70.0. The issue is a code injection vulnerability where attackers who control input schemas can supply a malicious customBasePath containing embedded newlines and a dot-free Python expression, which is emitted into a generated fro...
ThinkPHP < 3.2.4 - Remote Code Execution
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via the s parameter in index.php through the invokefunction functionality. id: CVE-2019-9082 info: name: ThinkPHP 3.2.4 - Remote Code Execution author: 0xanis severity: high description: |...
Linux Distros Unpatched Vulnerability : CVE-2026-66373
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same...