265871 matches found
CVE-2026-66040
FFmpeg
CVE-2026-66040
FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. Attackers can craft an eXIf chunk where multiple I...
GHSA-74H3-CXQ7-VC5Q Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id
Summary An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller geteventcall delivers execute:python / execute:tool events to a client-supplied sessionid after only checking that the sessio...
GHSA-4R2P-27MH-5M22 Open WebUI: Stored web worker XSS via Pyodide
Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...
SUSE CVE-2026-16806
Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
GHSA-W28W-GP39-M4P6 Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Summary The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. Affected packages - npm...
GHSA-3RP5-JJMW-4WV2 GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
Summary In GitPython None: if isinstancename, str and UNSAFECONFIGCHARSRE.searchname:...
GHSA-7GFH-X38P-PRH3 Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...
GHSA-MV8W-475R-VWQW seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...
GHSA-HQ9Q-27G5-QWPJ Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Summary kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand and dependency name/version as the tool's own recommended install...
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
Summary kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand and dependency name/version as the tool's own recommended install...
EUVD-2026-41089
Ray: Arbitrary code execution via ray.data.readwebdataset default decoder: pickle.loadsvalue and torch.loadweightsonly=False...
CVE-2026-65704
A flaw was found in FFmpeg. A remote attacker can exploit this vulnerability by providing a specially crafted ffconcat file, which, when processed with the -safe 0 flag, triggers an out-of-bounds write. This occurs due to improper bounds checking in the TY demuxer's demuxaudio function, leading t...
Exploit for Interpretation Conflict in Wordpress
CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Au...
Exploit for SQL Injection in Wordpress
CVE-2026-63030 & CVE-2026-60137 — wp2shell WordPress Cor...
CVE-2026-16806
A flaw was found in WebMCP, a component of Google Chrome. This vulnerability, known as a use-after-free, allows a remote attacker to execute arbitrary code within the browser's security sandbox. This can occur when a user visits a specially crafted HTML page, potentially leading to unauthorized...
K000162426: Apache ActiveMQ vulnerability CVE-2026-34197
Security Advisory Description Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access...
Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say
Redis shipped seven security releases on July 23 after researchers published authenticated RCE PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0. All four chains require RESTORE. The Streams chains also need EVAL and XGROUP; the 8.8.0 chain needs EVAL and the bundled RedisBloom module. Redis...