JetBrains TeamCity < 2026.1.3, 2025.11.7 - Remote Code Execution

JetBrains TeamCity 2026.1.3, 2025.11.7 contains a remote code execution caused by unsafe XStream deserialization in the unauthenticated agent polling protocol. The XStream instance serving /app/agents/v1 is created without NoTypePermission.NONE, so XStream's default type permissions Throwable, Ma...

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

Atlassian Confluence Data Center and Server - Remote Code Execution

Detects a Remote Code Execution vulnerability in Confluence Data Center and Server versions prior to X.X affected versions. This issue allows authenticated attackers to execute arbitrary code. id: CVE-2024-21683 info: name: Atlassian Confluence Data Center and Server - Remote Code Execution autho...

IncomCMS 2.0 - Arbitrary File Upload

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. id: CVE-2020-29597 info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: |...

Unauthenticated Remote Code Execution – Bricks <= 1.9.6

Bricks Builder is a popular WordPress development theme with approximately 25,000 active installations. It provides an intuitive drag-and-drop interface for designing and building WordPress websites. Bricks = 1.9.6 is vulnerable to unauthenticated remote code execution RCE which means that anybod...

Linux Distros Unpatched Vulnerability : CVE-2026-114550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut...

SUSE SLES15 Security Update : nodejs22 (SUSE-SU-2026:5036-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5036-1 advisory. - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482:...

openSUSE 16: brotli / libbrotli-devel / libbrotlicommon1 / etc (openSUSE-SU-2026:22213-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22213-1 advisory. This update for brotli fixes the following issue: - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution bsc1287778. Tenabl...

SUSE SLES15 Security Update : nodejs24 (SUSE-SU-2026:5037-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:5037-1 advisory. Security issues fixed: - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent...

openSUSE 16 Security Update : nodejs22 (openSUSE-SU-2026:22210-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22210-1 advisory. - CVE-2026-105481: Keep-alive socket process a response that was written before the request was sent bsc1286565. - CVE-2026-105482: dns.resolve...

PT-2026-137511

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07 Description Improper Control of Generation of Code allows a remote unauthenticated attacker to execute arbitrary code on the server. The issue occurs when an attacker stages crafted widget XML via a...

CVE-2026-108387 radare2: Remote code execution when loading Pebble/SMD binary

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo-bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radar...

CVE-2026-108387

The radare2 reverse engineering framework (prior to version 6.2.2 ) is vulnerable to Remote Code Execution (RCE) . The flaw exists because attacker-controlled data from specific binary format plugins can reach RBinInfo-&gt;bclass. By opening or analyzing a crafted Pebble or Sega Mega Drive binary...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps

Summary Multiple vulnerabilities have been addressed in IBM Aspera Enterprise Webapps version 1.0.8 Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml's Constructor class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by...

CVE-2026-82418

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vulnerability...

CVE-2026-122135

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-122134

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

CVE-2026-82418

IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0 are vulnerable to a use-after-free vulnerability (CWE-416 ). The root cause lies in OpenSSL versions included in cryptography wheels prior to cryptograph 48.01 , which can be triggered by specially crafted PKCS#7 or S/MIME signed m...

EUVD-2026-117088

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

EUVD-2026-117089

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...