CVE-2026-67965

Tenda W20E V5.0 firmware US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin exposes url_need_login to bypass authentication when the admin password is empty (factory default), enabling unauthenticated activation of /goform/ate — an AES-128-CBC backdoor on UDP/7329 using hardcoded key Tenda0123456789M...

EUVD-2026-60448

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

CVE-2026-50768

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

PT-2026-76772

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

CVE-2026-67960

PbootCMS v.3.2.15 is vulnerable to arbitrary code execution through multiple components: MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php. The vulnerability is exploitable over the network with low complexity , no privileges required , and no ...

VulnCheck KEV: CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

CVE-2026-50775

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly...

CVE-2026-68004

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

PT-2026-76705

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2.1 Description Remote Code Execution RCE is possible through the Markdown export tool. Recommendations Update to version 2026.2.1...

The vulnerability of the Jolokia component in Apache ActiveMQ allows a hacker to execute arbitrary code.

The vulnerability of the Jolokia component in Apache ActiveMQ is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-76880

Name of the Vulnerable Software and Affected Versions Halo version 2.25.4 Description A remote attacker can execute arbitrary code through the installFromUri method within PluginEndpoint.java and the DefaultPluginApplicationContextFactory components. Recommendations At the moment, there is no...

CVE-2026-50773

CGM ISIS MED (CompuGroup Medical, Germany) version 2510.1.0.20 is vulnerable to arbitrary code execution via a crafted .dll file . The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector requiring user interaction but no privileges. CISA's SSVC assessment rates exploitation as poc (proof-of-c...

CVE-2026-67925

JeecgBoot v3.9.2 has a stored XSS flaw in the /airag/chat/upload endpoint, exploitable by an unauthenticated remote attacker with user interaction required (CVSS 6.1). No patch version or PoC is provided; affected organizations should monitor the referenced GitHub issue (#9773) for remediation de...

CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

EUVD-2026-60444

An issue in Tneda W20E v.16.01.0.62782 allows a remote attacker to execute arbitrary code via the urlneedlogin function...

CVE-2026-50772

Squirro Cognitive Search versions below 3.14.2 contain a flaw in the password reset function allowing unauthenticated remote attackers to execute arbitrary code, rated CVSS 9.8 Critical. A proof-of-concept exploit is available at https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50772; up...

EUVD-2026-60450

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

EUVD-2026-60446

Buffer Overflow vulnerability in SteelSeries GG macOS v.107.0.0 allows a remote attacker to execute arbitrary code via the libSSEdevice.dylib, dupwcs components...

PT-2026-76687

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /new run endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be able...