CVE-2026-122135 Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configured gpg.program during project context collection. A crafted repository setting gpg.program and log.showSignature with a signed commit makes git log execute...

CVE-2026-122135

Mistral Vibe versions before 3.0.3 are vulnerable to Remote Code Execution (RCE) during project context collection. The root cause is the abuse of repository-configured gpg.program settings; a crafted repository containing a specific gpg.program and log.showSignature setting, combined with a sign...

CVE-2026-122134 Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers

Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens a crafted repository, ProjectContextProvider.fetchgitstatus runs git status at startup,...

CVE-2026-122120

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

CVE-2026-57853

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

CVE-2026-122120

In Yealink Plug-in Softwares versions prior to 2.35.219.0 , an unauthorized file write vulnerability exists under specific scenarios. This flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and can be exploited by attackers to achieve remote code execution . The vulne...

CVE-2026-122120

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

EUVD-2026-117014

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

CVE-2026-57853

DataGerry versions prior to 3.3.0 are vulnerable to a server-side template injection (SSTI) vulnerability. Authenticated attackers with base.docapi.template.add permissions can inject arbitrary Jinja2 payloads into the template_data field using POST /rest/docapi/template. When a user requests the...

CVE-2026-57853 DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

EUVD-2026-117011

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

CVE-2026-57853 DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the templatedata field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja...

Security Bulletin: IBM TS4300 3U Tape Library is vulnerable to remote code execution (CVE-2026-109618, CVE-2026-109619)

Summary IBM TS4300 3U Tape Library is vulnerable to remote code execution. Vulnerability Details CVEID:CVE-2026-109618 DESCRIPTION: PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

CVE-2026-76506

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

EUVD-2026-116971

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

CVE-2026-76506 Cisco Unified Computing System Central Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

CVE-2026-76506

A vulnerability in the Cisco UCS Central Software web-based management interface allows an authenticated, remote attacker to achieve remote code execution or perform information disclosure . The root cause is insufficient validation of user-supplied input in an HTTP request. A successful exploit ...

CVE-2026-76506 Cisco Unified Computing System Central Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This vulnerability is due to insufficient validation of user-supplied...

Updated minetest package fixes security vulnerabilities

The client mesh loaders suffer from memory safety issues including unbounded out-of-bounds heap writes and use-after-free, which might be used to obtain arbitrary code execution on the client. High Installing content from an untrusted ContentDB instance can result in remote code execution. Modera...

CVE-2026-109518

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic including a malicious mirror or proxy between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified...